MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51a6d60c4bc7ef9118600cc0db492a5187f581bd28a5541914a0764fdd2a5525. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51a6d60c4bc7ef9118600cc0db492a5187f581bd28a5541914a0764fdd2a5525
SHA3-384 hash: 2808ebe293ba605ba71774012e0fbdc3659905b969c6abe42dd3c3513f6778f75fdd7fa7cd43d21dbb723973c436b22c
SHA1 hash: e4759a1b377765377944f2b218d867463d9ff4d5
MD5 hash: f9a2d7512ae014fc15bfabfa0c9983af
humanhash: three-high-missouri-artist
File name:b418dfd1ab087ff0f2a34815a1e9eb4d.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:298'496 bytes
First seen:2020-04-03 19:22:00 UTC
Last seen:2020-04-05 07:35:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:w8pV7SWmzwzWjeBHWVxUVRlVin5A+MkkT6dJuYT0Nb/ko2TV:wHWejQcxv2+MkkT6dJb6ko2TV
Threatray 10'597 similar samples on MalwareBazaar
TLSH AE54296D2B88B902FB3D5D3289D1666016F1D4834E22CB0F6EC51EED7F527C92C4A396
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1MKc78eivE27QGb5P4Qoc2pTDXBN_bacy

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-03 19:35:59 UTC
File Type:
PE (.Net Exe)
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kgtnmdcly7xzcgdabtanwsjkkgd7lan5fcsvigiuub3e7xjkkusq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
12afcd370e4beae67e78b936b7ba8035642ea4e5921a332b0a8ffac8452fa0ac
AgentTesla
2474586827d8955e084438012fb1b977249fb8754137bd1ac0071dbaa6ba22aa
AgentTesla
2fcc3c49cbacd359f308ab59cbafdec24f95d4b638bf9c2fd5dd466379dac3aa
AgentTesla
69743cf570a9635bebdf3c89b4ad7c6824efac3c2c3ee33577177fb7954848a6
AgentTesla
76aeceb07ade4e0dca6cf046b682ae5909f578b725da30d10a46c6fb58cc3f33
AgentTesla
ba6d3319514c66b0b43c4dfa29ace7eadc90119cba7c3d1a86c3fb7fa9711a0e
AgentTesla
c5a4176174c6cd1b56e9e5dc37d4338bbede8af3db82c53a94e41b359bc8c98c
AgentTesla
d054fd7ff375bd7390235a1a8e48e162c3211d4e2f27040de4bc6ba1f0b0746b
AgentTesla
f5353450e85c44b4e012983d33ff1dba5ced57cec7d38761d4298384a660629a
AgentTesla
f8ccdf4d24a9ca91670d55df56bbea28e7e94f42c89d55e18843d123b3cdbca9
AgentTesla
+ 10'587 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

8e43a2b5d6dfdca92040671396ca42cfb61a73aee47ebe22d74a66278b67f6bf

AgentTesla

Executable exe 51a6d60c4bc7ef9118600cc0db492a5187f581bd28a5541914a0764fdd2a5525

(this sample)

  
Dropped by
MD5 b418dfd1ab087ff0f2a34815a1e9eb4d
  
Dropped by
MD5 730d10dbfecfd6c45f26f1cab5ced50e
  
Dropped by
GuLoader
  
Dropped by
SHA256 8e43a2b5d6dfdca92040671396ca42cfb61a73aee47ebe22d74a66278b67f6bf
  
Dropped by
SHA256 59063e61596fa7eeb760ae833dc7cd133a9abc594f396349437b3fc05e622674
  
URLhaus
https://urlhaus.abuse.ch/url/334737/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments