MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1d81ae5a4ea7a71d5d7147565fecca141a8e03148ef3c9e7583b9159923d17a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1d81ae5a4ea7a71d5d7147565fecca141a8e03148ef3c9e7583b9159923d17a
SHA3-384 hash: edaf5d022c97a825502902b6e13d16181e5c5f7a2844ec74e090fbab144e0043d2ff1fc62836d47ba893f16583db2bec
SHA1 hash: 2bf0e077ab41c6272185c27cddae6e09a40db3cc
MD5 hash: 97df21cfb5d664e1666f45e555feb372
humanhash: moon-muppet-eleven-football
File name:iec56w4ibovnb4wc.onion_Library__Ransomeware__mcrypt.bin.malw
Download: download sample
Signature AgentTesla
Create hunting rule
File size:616'960 bytes
First seen:2020-03-18 22:40:55 UTC
Last seen:2023-06-09 06:54:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:uLyc0WC5/l3Ou49HfWiXGXGLGeWWfVFRP9LEHBvtLU1LBxNYQ86:8Ov5dn41fWiXGXGLFWWfVFRP9gvLmBxX
Threatray 58 similar samples on MalwareBazaar
TLSH C6D402463B8C4354E96C80F1C0FB182453F6A8CB2672E7963E585BD50E213E6FD93B99
Reporter ov3rflow1
Tags:AgentTesla malw

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Encoder.26658.24123.9093.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Filecoder
Create hunting rule
Status:
Malicious
First seen:
2018-10-24 10:38:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
37 of 47 (78.72%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0d179277dc17521d3f9668838ddc6cfe818f72ef5691c123443b9442295d90ff
AgentTesla
5548abe06d971143d889bb02d56403770e68907400349c8534ac99ecca193812
AgentTesla
59b230d608d121a6969fa2eab41b020c57f99328319ebd92ef00cb4081562589
AgentTesla
632fad824e77666d3ccb676808a2f04eb349f1f0f1495e75b37aa47e690ffe14
AgentTesla
82f9d45ee92a5f51af44dc11384e5a10fa12fbb46659291dc188a9222d17fc34
AgentTesla
b2f041348835c102db3769245ee4c28dd00cb19c3c6710fc9c11228f3bbce61b
AgentTesla
bd343b1b5db4f37db72ebf4abba33431c9e28fbb845e847ee1184270c8807204
AgentTesla
eac957f655d15206f8875a31eb0b225040ee39015ff01189901f78230e39c33f
AgentTesla
f95573e18dd16600bedc2ab6917774a91603d5e90ae5deccfa969a8311802972
AgentTesla
f9b03c723f0707c47dc00e0d77ac55559d2cd07cd6b38a67126e535068ca05dc
AgentTesla
+ 48 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Ransomware
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f1d81ae5a4ea7a71d5d7147565fecca141a8e03148ef3c9e7583b9159923d17a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high

Comments