MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb869c36b10e8188698c0c3cfd0631ae078b19d5c46fd90f4a328f60a7756cc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb869c36b10e8188698c0c3cfd0631ae078b19d5c46fd90f4a328f60a7756cc7
SHA3-384 hash: 4193e5b54b1b42d50e49ac6c54a20de3ec0c492f5b04166bfbd4d4cf6a733fc5769bd5978aa9209f1e60a7ffd8021722
SHA1 hash: d05fbb3f66771502c5bb7d312e00640cc92a8320
MD5 hash: 5d624c639844a0d464524f633b06e82b
humanhash: idaho-pluto-eleven-video
File name:42617ac52f45a3afe264ee480f61be6d.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:289'792 bytes
First seen:2020-03-26 15:44:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:4OZgm/jNdymuQEEWlVWosBiEavACit2hzAVW+SHHKQiFKbe:4OZHvTL/sYCiizAVW+SnK
Threatray 10'396 similar samples on MalwareBazaar
TLSH E554085DAB88B901F33D1D36C1DA926017B1D4835912C34F6EC90FFA7E5A7C9384E29A
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1ZOIGS82-bxHlNvvm2S8PFCGMX8juGFkj

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Spyware.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 16:37:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
32 of 47 (68.09%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7odjynvrb2ayq2mmbq6p2brrvydywgovyrx5sd2kgkhwbj3vntdq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3b4dbe0782b86290dfabf49c0605113792f1052c61e963cfdc875e98e41bc8c0
AgentTesla
3c913eb5c708579a85685ccee10a9ce487c51f9da743f2100c46e3e0e88d2569
AgentTesla
4242b7ecf6c53a0625bf1828a21eb604e328c5218161e698fcb815ad2dc597c0
AgentTesla
54abe2f6167464b18a5d454280231fd58f1e25f18f4376d6f7370ddd43ef6fb8
AgentTesla
709a9bbcd45777b8ed8b9c60ac3cd8733424c085fa0ef09f74479370b69c8dfd
AgentTesla
7d3fa90e5406de233bac6088b8e17d4f9a3684f2320451e2a5ee9ddcf24896b4
AgentTesla
a27b7d9bfdedc6a0dc4809c02ba1c76347fe2e38adf4fd4344f36e2b164d049d
AgentTesla
a621cde9778f6fe594633e515e55db31e70aab2109d72a12ad14e502dd873ec7
AgentTesla
aec940b3b93163265de9f8af67b2c278bd78a63a40e1691772dd0912f1559717
AgentTesla
eb18282566acfa61046f56dd07ef72397528a06b8765c6b033d5153bf9bee0eb
AgentTesla
+ 10'386 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

e75159297e83337fa90fd012eeb340e6cdb347ffce636cfff18bf7cf92f1ec59

AgentTesla

Executable exe fb869c36b10e8188698c0c3cfd0631ae078b19d5c46fd90f4a328f60a7756cc7

(this sample)

  
Dropped by
MD5 42617ac52f45a3afe264ee480f61be6d
  
Dropped by
MD5 7a86b20e8177271c67326736ab8ae40d
  
Dropped by
GuLoader
  
Dropped by
SHA256 e75159297e83337fa90fd012eeb340e6cdb347ffce636cfff18bf7cf92f1ec59
  
Dropped by
SHA256 92f02e0c8ef54357421d42c23492b03cbd2a18719025881d1169c7e5dcccfb53
  
URLhaus
https://urlhaus.abuse.ch/url/328763/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments