MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 687b91945faf3353eef05a5ca2b3e5816a8f36ba82e843cbabc760e4fdcd523b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 687b91945faf3353eef05a5ca2b3e5816a8f36ba82e843cbabc760e4fdcd523b
SHA3-384 hash: 9074e417e5b095960c51b867da6f8a346a2577d5124037a2bd1fda61bafd8c199eea87d2cd4538db6ec3b200de0e5e1d
SHA1 hash: 96d3235f3efdeae5b4fdd425eaa783b89cd4cf07
MD5 hash: 71048347cd37273f57d9c9ba66ef1a93
humanhash: massachusetts-july-minnesota-pluto
File name:186d56c2f6ecc06d0bfe17215f14b6b4.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'984 bytes
First seen:2020-03-30 10:50:10 UTC
Last seen:2020-04-06 15:35:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:i4ZCwhsiMUUoZLT841P10PrPH8db4oeT7:i4ZC5iTn0PrXoeT7
Threatray 10'429 similar samples on MalwareBazaar
TLSH C8544A6C7B88B902F73E293249D1666012F295834E12CB0F6EC45FED7F637C9294A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1W1xBfyk3VntJFzxdZyrEPHlxww_DoRIH

Intelligence

File Origin
# of uploads :
7
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 11:35:51 UTC
AV detection:
29 of 46 (63.04%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nb5zdfc7v4zvh3xqljokfm7fqfvi6nv2qluehs5ly5qoj7onki5q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0cf4378a60635fbed046a2afa593ac87c02b814cb0f2760fcf475d2abedfb12a
AgentTesla
1423fecef8733691b4fd6b8c8b426cf28509f2b9d0ea17608de08989998edc56
AgentTesla
238b5720f4f7c36b7eb7c7d894a94ed70caece21b28db5d02ef04040bc3681ec
AgentTesla
3acbeccd335e0141468ef85211cabec3f8cafc0583e94a0e59624905e972616d
AgentTesla
54e459b9722f9aa133e87abe7a92a8f5500cda7ba967ea9340978cee66631032
AgentTesla
8501b62ef01d0a8ffacb3e1c7bd13129fca8a621d00f14d81a1227cf6872c5fe
AgentTesla
b681ce953d7122c634acb0c68e4885a7e6d182acfbc43f886160b2796f452d99
AgentTesla
e528b878e209ef5fca0d2fb3d92531c13aaaaa9af90fac69d3fd88ff2942cc0d
AgentTesla
eb6b605e87d9b95d3025dc253f41a29839939410291038e1cbe630338578d17e
AgentTesla
fa02a7e8922b8a0a152ff8ced55d3b005e6eac67af9d9eff7ec03192b6d1aee3
AgentTesla
+ 10'419 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

83697e08b3043038abd366b291f5d5c9e70d3c949a5671d4ce53db4d6eac38c8

AgentTesla

Executable exe 687b91945faf3353eef05a5ca2b3e5816a8f36ba82e843cbabc760e4fdcd523b

(this sample)

  
Dropped by
MD5 186d56c2f6ecc06d0bfe17215f14b6b4
  
Dropped by
MD5 cf7ee374a410e1dddbadef42d07e82b3
  
Dropped by
GuLoader
  
Dropped by
SHA256 83697e08b3043038abd366b291f5d5c9e70d3c949a5671d4ce53db4d6eac38c8
  
Dropped by
SHA256 37a833796de80f13c2350d1a652a9aa04d42b45ef27d38b3f0d7f8b81c98e061
  
URLhaus
https://urlhaus.abuse.ch/url/332149/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments