MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39d0047c0a981b1d37d189f0e466fdeccf3408591d44bac4c549af7cee83fa69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39d0047c0a981b1d37d189f0e466fdeccf3408591d44bac4c549af7cee83fa69
SHA3-384 hash: 717592e9f76abc9b0d462e02ab5568fc58c18d16550df08dccb64fb9a9fe526542d30343d32d26ac2a1588620d491d05
SHA1 hash: 980cfc87b7ea6990c2f7c54cac0243b476a1ccc6
MD5 hash: 47c440df20d0b4d6414a10b8add99f0a
humanhash: angel-aspen-mississippi-october
File name:07027aa26fc00d34d26618a2f43dbac8.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'544 bytes
First seen:2020-03-28 17:09:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:hleXaavfZKPANDyJkXuU3zqvBfp3b2ojABD8blF/jbRoKT7:hQXahayJkXP3GdtZjABD8poKT7
Threatray 10'471 similar samples on MalwareBazaar
TLSH F5541A7D3F88B902F63D693289D5266012F2D5834D12CB0F7EC45BED7E627C92A4A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://mfpc.org.my/wp-admin/images/STB_encrypted_5B6E930.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-28 17:35:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hhiai7aktanr2n6rrhyoizx55thticczdvclvrgfjgxxz3ud7juq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
159bf6b29be05efdf2e536289ecbc6fe8a48368895c7331e03b94b2d497ad758
AgentTesla
1adbb491704dbef231e8c467ba7e74894c3ee818461ab28292ec32e3f9b74b5d
AgentTesla
1c52fdf3b0e990fcb41ea7b549f42b96be5d5ad6222f47384c2d1569c9469e1d
AgentTesla
7cf059a1d51541e4a746e4f8f624152801c40489e612bb46abd6a4bab26f6851
AgentTesla
8cf4d562d03815786cbd7e0fb3c18e5f7e257a216cb833b7e949a2c189ea79b4
AgentTesla
9b20b1817947f3b195de03856a8251019ca5f541256d450fe940c1bea7dabb45
AgentTesla
bf5ea94f9caf0f0db89ebbab1b2d022be6381423eee08d35afd2e14b465ea840
AgentTesla
c823d50b276192b513011547b0be2bbb66bed47f06e111f03858e3a9d72f0d6b
AgentTesla
e2d6119bb484c9e5f5a7107b4687553416208badbb881df4328bec5146d08509
AgentTesla
eb3d9d8c05443250dee20263c5ef307488815184b70bc97316ef4d8d4a26b74c
AgentTesla
+ 10'461 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

b7abb5ef84f709f616eb2a6d3d227a520cf20a8436f2d55f814ae65f4d585296

AgentTesla

Executable exe 39d0047c0a981b1d37d189f0e466fdeccf3408591d44bac4c549af7cee83fa69

(this sample)

  
Dropped by
MD5 07027aa26fc00d34d26618a2f43dbac8
  
Dropped by
MD5 f80ebefd054600c39a0eef6b00984f2f
  
Dropped by
GuLoader
  
Dropped by
SHA256 b7abb5ef84f709f616eb2a6d3d227a520cf20a8436f2d55f814ae65f4d585296
  
Dropped by
SHA256 28048d10e0690f75f8de693f8502ae7eb9926a2dfb092978841b4d5e1a95d85b
  
URLhaus
https://urlhaus.abuse.ch/url/331497/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments