MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e528b878e209ef5fca0d2fb3d92531c13aaaaa9af90fac69d3fd88ff2942cc0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e528b878e209ef5fca0d2fb3d92531c13aaaaa9af90fac69d3fd88ff2942cc0d
SHA3-384 hash: 0eb9700472c535bdb08eb77d7c542e369f115cb5965ea8f95575f8abde5f934c0d32198e6cb64cf1a2e5ca3f9c7aaaec
SHA1 hash: c8c8bb5543a621b5ea140dd7c457ca6fa1db1091
MD5 hash: facc65646a4dd13c30d8f44abee82862
humanhash: green-grey-moon-whiskey
File name:3be76ae63a2a7c14c4707eaebe9ca137.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-03-30 12:40:10 UTC
Last seen:2020-04-01 18:45:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:wrNC3sd4Tu2eyabvPiRKP5/jLlHaw1XsRNeutoesrjWcYTtdmb/oaTV:wrYYW7QT12BtoeMscoaTV
Threatray 10'464 similar samples on MalwareBazaar
TLSH 89542A7C2F88B902F73E593289D1566012F194834E13CB0F7EC49EEDBE527C9698A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1Fr0Vm1vKVXXy-biSRxUJzngyZzMCJ1yz

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 00:14:06 UTC
File Type:
PE (.Net Exe)
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4uulq6hcbhxv7sqnf6z5sjjrye5kvku27eh2y2ot7wep6kkczqgq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1cfd5099c6a8bf03aea60b09f4e7b829eadfcc1c0cc55f2c8bfbae01c03e56e2
AgentTesla
2d7e2c50d9fde2f20a360d73ec3545f50cff138d0ddaf14ae3833034fd7f2f9f
AgentTesla
453343ee05918e52f2f632b392dbbae994901b1c9cf244ad60443162085baa91
AgentTesla
63aff5b76a8668a56c015ed0ebd6938a488a74d721e84488f521c0ad45ef5d0a
AgentTesla
687b91945faf3353eef05a5ca2b3e5816a8f36ba82e843cbabc760e4fdcd523b
AgentTesla
6e077f8a754b865c8322b86fd21be4c9f6e013e0deed9003671c624033795cf0
AgentTesla
74997c97a74d715ea7037d6265d944feacca559b5527a9a9a27d022b5ebbb3b9
AgentTesla
772d2f2ea97be3c0b9948701fb6743fc8f717680420fe5ce0101eac3ac6cd1c7
AgentTesla
d7b59d350dd16d5c6a39706ba5dade34574798379ac54f0fa0cbea42158435ac
AgentTesla
e900c3505d7f63d785fb86b4ee53ebd3def2d764f881d6015aa224ea59a098c3
AgentTesla
+ 10'454 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

97b375e8b881d76baf21d22b5ffef5358cfc700447ca398e513eb768c15d1bc8

AgentTesla

Executable exe e528b878e209ef5fca0d2fb3d92531c13aaaaa9af90fac69d3fd88ff2942cc0d

(this sample)

  
Dropped by
MD5 3be76ae63a2a7c14c4707eaebe9ca137
  
Dropped by
MD5 1ea6a9b5b73809106fcc41c176c1c566
  
Dropped by
GuLoader
  
Dropped by
SHA256 97b375e8b881d76baf21d22b5ffef5358cfc700447ca398e513eb768c15d1bc8
  
Dropped by
SHA256 eb8a185f3814c6a8ed60470e7a9aa11302305d2ab546b047c89d2865f67074f3
  
URLhaus
https://urlhaus.abuse.ch/url/332171/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments