MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8ccdf4d24a9ca91670d55df56bbea28e7e94f42c89d55e18843d123b3cdbca9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8ccdf4d24a9ca91670d55df56bbea28e7e94f42c89d55e18843d123b3cdbca9
SHA3-384 hash: d9d67597fc1c913bf813ae15facc4a9c119031dc1ddafcfb034d3a6d3bcf97c997b65aacea27e193b0f8496f5de942ab
SHA1 hash: bd8db408e7ef76d2228a152160ef34e8fe0b5500
MD5 hash: 3f1cc5a4b908345e608c3aab5d583d33
humanhash: kentucky-south-twelve-gee
File name:1b6a7cc219a5cba9211d397510ced872.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-04-02 11:35:10 UTC
Last seen:2020-04-03 14:05:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:QEpV1kA07QUCiEir70agI56tiVDmROmtYZYTsvPbBoCTV:Q+7m7pJbrj6ED2IoCTV
Threatray 10'574 similar samples on MalwareBazaar
TLSH 1F54197D2B88B902F73D593389D1266052F294834E12DB0F7EC41BFD7E667C9284A3A5
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1mzHmnElvrqYEoI7Gpb35heKt4UL4wpzI

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-02 12:35:23 UTC
File Type:
PE (.Net Exe)
AV detection:
31 of 47 (65.96%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7dgn6tjevhfjczynkxpvno7kfdt6st2czcovlymiipishm6nxsuq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
04fd9df0e5ec9e9f2ddebfa497adbe3c57876dd52d8b778cee3701f21cf02986
AgentTesla
11fb8b183a3d236fd9a880bf6be7d68b14ca69de28c8af2bf1d7864d595915f0
AgentTesla
1a258f5509ae1bb4edace69afd414ba2f0cb4a708f73d6d3109aa027117cd5a1
AgentTesla
2ac203d2ba2fc79f4fa43ea2fff3b6e2d9a30bb8d73f6c809c50f8882913b373
AgentTesla
4297b0f564c12f9b864cb9c48b6b408ca13349dcc557c3243fe398d4921a8a8b
AgentTesla
51a6d60c4bc7ef9118600cc0db492a5187f581bd28a5541914a0764fdd2a5525
AgentTesla
7a3ccb191798f72fb41fb65d66efe2ffc82c848bf1a6d96738a4834a51d71761
AgentTesla
8cacb4c01a703f8a300130d23fe74ab651ce7916a701357cb14b468e2a816a3d
AgentTesla
b2dfba1ce7b2522089f2d409187d5661483e581e893f7fb6fa681b5dbebed71c
AgentTesla
dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f
AgentTesla
+ 10'564 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

GuLoader

Executable exe 2aa324195b641499159816aa2ba8f40f6c5d971bcbee5a753d330df383867248

AgentTesla

Executable exe f8ccdf4d24a9ca91670d55df56bbea28e7e94f42c89d55e18843d123b3cdbca9

(this sample)

  
Dropped by
MD5 1b6a7cc219a5cba9211d397510ced872
  
Dropped by
MD5 bff1e9e42f3ef46055d5073e975b4b76
  
Dropped by
GuLoader
  
Dropped by
SHA256 2aa324195b641499159816aa2ba8f40f6c5d971bcbee5a753d330df383867248
  
Dropped by
SHA256 726454535afe7551e723bc4afd1bba6c40549efab79d0c1618db14efacff0f6d
  
URLhaus
https://urlhaus.abuse.ch/url/333899/
  
URLhaus
https://urlhaus.abuse.ch/url/333083/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments