MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5204a5f0990786d30e0f35b00f422c32f0f075461183a64f708c1215b784863c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5204a5f0990786d30e0f35b00f422c32f0f075461183a64f708c1215b784863c
SHA3-384 hash: 8edd14cd803b5346d84eb5a8e62d1b5eac4ca9e4155c6e25bd45083b629f2593e8f4b296b4e0c7a34c8d8c2a4034dd31
SHA1 hash: 2b2ae9aa06d9e87515c96872ce19c7069c67f9ce
MD5 hash: 0857907d2c941a415b9435412420a391
humanhash: six-sweet-fix-king
File name:439e82d97c800a6db58602e73599182c.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'472 bytes
First seen:2020-04-02 11:35:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:S0lIxVMtZxjsr+zfPoGKudhge99JR+qyLT8CF1ebGoWTV:raMt7zfPoGZF93+qk4ioWTV
Threatray 10'603 similar samples on MalwareBazaar
TLSH D9542A7D6B88B902F73D493289D1567022F294934E22CB0F7EC51EEDBF527C9285A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=16zAoYQQ3Hh_m8soViKOS2T_1j31L8Q-f

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-02 12:35:21 UTC
File Type:
PE (.Net Exe)
AV detection:
30 of 47 (63.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kickl4eza6dngdqpgwya6qrmglypa5kgcgb2mt3qrqjbln4eqy6a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0f3796394a5e425855d842187813997be61e79058cfc546da575b27cf8c09ffb
AgentTesla
218eadf397c142440e7c54221a6faf836e512446e8d39b850114565b0ca36331
AgentTesla
3845a8f1b22212dbb08c6a9c95c3cc765a2d9676dbe367acf2c24f845b264bf6
AgentTesla
4c5059b083f118ba52446e36d927f9cd8fe6039a1f320ab2ffda0682e03fc5fe
AgentTesla
8b9f6849440f674a9153aba96031b10ca35fe0cc7a42d47d8bd4f6a5003c21fe
AgentTesla
bacaaa40e0f3b6cba3fc498dfbd6f2d198a767453cd8513acdbafa9fefaeed2a
AgentTesla
bcfe28b074cc1d9b0fb7896ee3eb4d28c240bee33cb76578f0f9f1ef90ab92e6
AgentTesla
d8f57352e6424ae0305cb9ef00e2e119a94610bf4564f0df8b89044a46d2c36a
AgentTesla
dc96599b170adfa59f1b9af065ca1608cdc0458a6678fdc84d38bbc61bcbc2b3
AgentTesla
f8166c3c857a7a3ba99515cf6ae242a78050fba7608e24a88e2559e0063a187a
AgentTesla
+ 10'593 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

2d8acef271db213319fcbb903505b1b8928dab5aee4f8a0de8173280f91eff7a

AgentTesla

Executable exe 5204a5f0990786d30e0f35b00f422c32f0f075461183a64f708c1215b784863c

(this sample)

  
Dropped by
MD5 439e82d97c800a6db58602e73599182c
  
Dropped by
MD5 c5c7210851b7aa9231051aa8db9169d3
  
Dropped by
GuLoader
  
Dropped by
SHA256 2d8acef271db213319fcbb903505b1b8928dab5aee4f8a0de8173280f91eff7a
  
Dropped by
SHA256 522f2eb261545333278c02993d143b65aabb685522d37d29d00169027f0f2004
  
URLhaus
https://urlhaus.abuse.ch/url/333900/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments