MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5841754eb3bf70c6eebd7e95b270cff96fb86d370f031b6430af922c99364722. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5841754eb3bf70c6eebd7e95b270cff96fb86d370f031b6430af922c99364722
SHA3-384 hash: 960d721ddb3f5382f4da51b52e3595d9c717c9714a32f00bfad070e7a6f27df800484d739fb42e28a866f119e23b7122
SHA1 hash: 7993eac0d174314a7a1494c0fb6178c3cc451185
MD5 hash: 2b76960d7bf16f617085b05b09193bbd
humanhash: neptune-four-zebra-venus
File name:20f069fa273ee16d832573daa54059f7.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'984 bytes
First seen:2020-04-09 14:46:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:MH5vvb4DD781D9fuJ3ZliAHy3NetB/tm3YTDbRtouTVWr:S5j6MEpliMmUTouTVWr
Threatray 10'712 similar samples on MalwareBazaar
TLSH 5454297C6B88B902F73D5D3289D1566122F2D4834D22CB0F6EC41FED7B5A7C9284A399
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1h9sKShRj8GDDnMe9pWCNhBzJP6OHMovs

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-09 15:35:23 UTC
File Type:
PE (.Net Exe)
AV detection:
28 of 45 (62.22%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lbaxktvtx5ymn3v5p2k3e4gp7fx3q3jxb4brwzbqv6jczgjwi4ra._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
127e1f8b350c1c2fd23b51a0245c2025cf7eb5244f79bd7ae8ba5ab9c18ca361
AgentTesla
314843bc96cbfa3115bc86edd37758ecdaaf6af6ae543a64014e921fda7294fb
AgentTesla
5e3e874b7f87124567d4716a6f0e8d696bae261550b399649a9fb3a85f2e0d5a
AgentTesla
66d52222a705c3045fecbb5049dc95e060061459909a6c79c73115e5b0c70cb3
AgentTesla
751bf8fd813455834ff278900b4e561262aaf06459a49d8631fb6ffa73472674
AgentTesla
874e5493086a501512f7367f1fc2dd63a9605466ef44ba598f52a21fb75c95f5
AgentTesla
a0cec73b76fb458543566627fab866c8022867bf16095164ef94ad0f54be2867
AgentTesla
d43c6aba8577d6f6e846545d25587748ff13e676320936f4c3104ba94e22e24c
AgentTesla
d45904e380138c708127a69e9623c5928748a3bf643578f7f3994d744e326ef0
AgentTesla
f57973fe9b7144fd299f70cc04bcde1e442f6816de323361f1b09cb63c4e41b4
AgentTesla
+ 10'702 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso b9df2f1b0af14abe76816fd4bdbced790b358bfdf1147386e5c1ce5f1e83c6af

GuLoader

Executable exe 133531deb093f5e5684d02dd919901e8cb5369b81f9a36ef919451bf02555e55

AgentTesla

Executable exe 5841754eb3bf70c6eebd7e95b270cff96fb86d370f031b6430af922c99364722

(this sample)

  
Dropped by
MD5 20f069fa273ee16d832573daa54059f7
  
Dropped by
MD5 5961705cc3ebc5b1ee795eec7e8e348c
  
Dropped by
GuLoader
  
Dropped by
SHA256 133531deb093f5e5684d02dd919901e8cb5369b81f9a36ef919451bf02555e55
  
Dropped by
SHA256 152ed222548b82ff43b0828766ccd03567737397de6a8d927833a3e6a444ec79
  
URLhaus
https://urlhaus.abuse.ch/url/337287/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments