MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3acbeccd335e0141468ef85211cabec3f8cafc0583e94a0e59624905e972616d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3acbeccd335e0141468ef85211cabec3f8cafc0583e94a0e59624905e972616d
SHA3-384 hash: 8262e874ef9573cfec71f8f2c5ec0a001b3ec94fbc65fdbb497fb72d55fc01af2b2b23942789fe71d250aaa66f6ef0f3
SHA1 hash: 0230d4ac940739c0151655506ca24a89d8c75a16
MD5 hash: 0e313de63a7b46d2bc584e232f2df790
humanhash: yellow-shade-uncle-timing
File name:elb.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'984 bytes
First seen:2020-03-26 05:58:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 6144:ZonylKuv2yWKvFUyiSMfWcKmEX7KXRF9GuNkb2aoGTV:OnylKJlUWaMWoGTV
Threatray 10'400 similar samples on MalwareBazaar
TLSH 5B543A6C2B88B902F73D5E3289D1666112F2D4834D12C75F7EC51FEDBB527CA290A386
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-25 06:14:58 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hlf6ztjtlyaucruo7bjbdsv6yp4mv7afqpuuudszmjeql2lsmfwq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01d43d7cb3dbec2a63010278022dfc40b9ae38d39ac709e06c612635ad0fe51a
AgentTesla
238b5720f4f7c36b7eb7c7d894a94ed70caece21b28db5d02ef04040bc3681ec
AgentTesla
39f941ff6d8ec16ef4b15952ab1107b7fd652a651f75ec8ed3125bd741819b0f
AgentTesla
54e459b9722f9aa133e87abe7a92a8f5500cda7ba967ea9340978cee66631032
AgentTesla
577c53f979f75e226ccd9908f2aebb38fe38667a53509565ae906b5a6bfdce28
AgentTesla
5ecfea430f1801299be4a50346c041ba396e4b7e30f635f7ec579ebf56328d80
AgentTesla
687b91945faf3353eef05a5ca2b3e5816a8f36ba82e843cbabc760e4fdcd523b
AgentTesla
8daf58146648177ecc0b8da2ee4068ef7886065792c7f6fa9eb03fc77c041e83
AgentTesla
b7f91e8b80d469bdd1ab452b999a839daff2bd5deb86d24d9a197e7a2941b604
AgentTesla
fa02a7e8922b8a0a152ff8ced55d3b005e6eac67af9d9eff7ec03192b6d1aee3
AgentTesla
+ 10'390 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Excel file xlsx 54e459b9722f9aa133e87abe7a92a8f5500cda7ba967ea9340978cee66631032

AgentTesla

Executable exe 3acbeccd335e0141468ef85211cabec3f8cafc0583e94a0e59624905e972616d

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 54e459b9722f9aa133e87abe7a92a8f5500cda7ba967ea9340978cee66631032
  
URLhaus
https://urlhaus.abuse.ch/url/330126/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments