MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8a7115b77013584dd55f6d7031f563707c31886394018505069e6a7420d6a3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8a7115b77013584dd55f6d7031f563707c31886394018505069e6a7420d6a3a
SHA3-384 hash: 10a308abd27e7489458a3751dac16654afd353284ea6acc791b83e0f0317cdb3e4c2a5dcc41176e17319da725fb86925
SHA1 hash: fceb358e9f530852bdfa4e442c849dd7789af9b6
MD5 hash: 202e41f91128d0da197321c644e04909
humanhash: seven-steak-johnny-island
File name:481977d84b6b0d9cd83e2a51e9e3b8db.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:301'568 bytes
First seen:2020-04-09 18:35:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 6144:5GaqSLfzWOBNPAZd84wFNAvaDXDPPSAr41KrX/ObGyOm:5GEW8dAfwtDua40tyOm
Threatray 10'681 similar samples on MalwareBazaar
TLSH 73543ABC6B58B902F23D5D3285D5122512F1D083CE22D34F6EC84FE87F697DA2A49396
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://cdn.discordapp.com/attachments/690091339840618509/697220397686325248/MyorigV4_encrypted_B0EA8FF.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-09 19:36:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
26 of 30 (86.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ctrcw3xae2yjxkv63lqgh2wg4d4ggeghfabqucqnhtkoqqnni5a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
003821b2e5b59f6688fe51752164c575ef41e230d206a13c365067c5bbd02000
AgentTesla
2dafd5f1570c579446d2b06ba815302da926c49683a36fe643241f1bd2144ac0
AgentTesla
5d100d55c4d2acf92f6f690e546c5a0e7ad6750520809a3f226783d99623aed7
AgentTesla
71977c1c4e1dd50aa73bb75cf7d9319acf0c30c50368b0d12d7066fee48fbf65
AgentTesla
9cf9d13d69b11af516333e927a36a236257665a78a6f5aa793ec10c5b061e6a8
AgentTesla
a99c63afeaf9ca1c09ee416f4415b50ec930ab489e3cc29908d7369c4869e500
AgentTesla
b326e71388c8abfb8e0e74aa913863af33e3299ad79fa42dd2d3e4c44e63da2a
AgentTesla
b724556bd0d2324ae566eb3a0c2f433bdbb2d2e4d83d4e6e0058d6c8b1edf188
AgentTesla
edefb92e5128b8548482615f2d8a1728557e0a076ceb73b293b7d95333c193f9
AgentTesla
f8b881049eff27232d360fb3a623e75ff7504b4da918cbd6666c917ddb38ef73
AgentTesla
+ 10'671 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

fe324ebaa8ef19ce054550fac2d17355f2547d45aecdc4312da346799c88e703

AgentTesla

Executable exe e8a7115b77013584dd55f6d7031f563707c31886394018505069e6a7420d6a3a

(this sample)

  
Dropped by
MD5 481977d84b6b0d9cd83e2a51e9e3b8db
  
Dropped by
MD5 bd15c417fd4dd383f93ba9ec0f20fe08
  
Dropped by
GuLoader
  
Dropped by
SHA256 fe324ebaa8ef19ce054550fac2d17355f2547d45aecdc4312da346799c88e703
  
Dropped by
SHA256 784f1101e7274f54ef99cc040752558424624eea5d6d999c9200a4ba440b6721
  
URLhaus
https://urlhaus.abuse.ch/url/337558/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments