MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f6a62a875f45c0e3e56e31bf6af3b0627e5946f23cb5247b56b962848e467bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f6a62a875f45c0e3e56e31bf6af3b0627e5946f23cb5247b56b962848e467bd
SHA3-384 hash: 32baa7a411a20c248a67b0ef86d7e1ccfe6c88c24f963009964149f7fe4625d7d975db7ebdcc8ef807109d54df17b650
SHA1 hash: 18c1d91b3933542b71c174620a20694aa521e9fb
MD5 hash: 5a2f4e662ec0a324e5f6a6b0216be8db
humanhash: juliet-white-shade-black
File name:3d16aa03e2d4e4181d76d9eb21e1469c.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-04-06 11:30:09 UTC
Last seen:2020-04-08 17:38:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:+ys8QsEw1yGSJh+2+UhbFyfcQbLWQiH5hYTZzbVouTV:jZyw1bs+UhGcwLWQiZyHouTV
Threatray 10'571 similar samples on MalwareBazaar
TLSH FF54197D2B88B902F73D5D3289D1667022F194834E22CB1F6EC41BED7F567C9294A386
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://onedrive.live.com/download?cid=41F2978DA9CE0256&resid=41F2978DA9CE0256%21111&authkey=AJZp62LMPZKHUMQ

Intelligence

File Origin
# of uploads :
4
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 11:36:12 UTC
File Type:
PE (.Net Exe)
AV detection:
29 of 47 (61.70%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5vgfkdv6roa4psw4mn7nlz3ayt6lfdpepfver5vnolcqshem66q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3168af462696c8edf2bb2ab1537782ca60135573d977c6d3264ca2069871d9b5
AgentTesla
37f3611503d3e8828f5acc568dc065e4fadc60558d1812d3473140d21146c0b4
AgentTesla
38a112ac5ecf5d11e3e4f70fe462ec424bd0aa8c67495ac6744b0bbb8082f5ba
AgentTesla
4a2c1f3c1df5c34f1c99c8f7cc8b18fae2c71189e6e383face3ff7fa31224f52
AgentTesla
5a2965c63c2c74a0e8d06008ead3a82354dfd319468074823d5224a63e1a5c52
AgentTesla
5b0318eb9cce4cbe0d3b9e157e018efe32ef71008472f5e5238f1939361ba96d
AgentTesla
9425f9a54ad43dca39af1cd5f86eb4570927c5ee5d21cbe69e9ed2774fc1f676
AgentTesla
d403f486cffb2d3bf09fcee5346aa4a2da61f50236473c13508e57ea7847b2e5
AgentTesla
dff01b9f8946ed3792fe4e32ae3f95834c892f16ca219dc99d78fd15064f82a2
AgentTesla
f35fa2a6281a2a24016729d315083a638edf176a890a605dba2ac134e1733bb3
AgentTesla
+ 10'561 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

8ec99b01f96e2e6ddd6a6a7a566af5ae59619c673304b2401b92ec9b504b5f62

AgentTesla

Executable exe 1f6a62a875f45c0e3e56e31bf6af3b0627e5946f23cb5247b56b962848e467bd

(this sample)

  
Dropped by
MD5 3d16aa03e2d4e4181d76d9eb21e1469c
  
Dropped by
MD5 c7fcd13ece83fb6d45a6212e5d59e081
  
Dropped by
GuLoader
  
Dropped by
SHA256 8ec99b01f96e2e6ddd6a6a7a566af5ae59619c673304b2401b92ec9b504b5f62
  
Dropped by
SHA256 c0aab2ff1fb15b2fa510238630955bdf5437d5979666cc5e748aee18182c6b71
  
URLhaus
https://urlhaus.abuse.ch/url/335752/
  
URLhaus
https://urlhaus.abuse.ch/url/336284/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments