MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d188a0945681b28e2c289de2c82ab3a5fd7f15a94b9354b62f0808406d51b56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d188a0945681b28e2c289de2c82ab3a5fd7f15a94b9354b62f0808406d51b56
SHA3-384 hash: e6cda8b943df54ce25fe9b8c4faaa56a49d1a7fdb21a82a9faee8036fe392633cf1ab16ba8faf47402d09cec94dbf26a
SHA1 hash: cb048e8b78dbbcda6ab0fb7dca555d141afbd1b3
MD5 hash: 8ec79ad9d56c8d458febd1c69b9069d8
humanhash: red-fix-kentucky-arizona
File name:b5b6fabd7df7177a9f32f134905bf465.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'984 bytes
First seen:2020-03-29 22:05:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:X0/W5JmVc661i53zJck9oPVZJLZ7SPFi/x4YTkb2HomTV:X0/swm6eJNZ2PU5nomTV
Threatray 10'545 similar samples on MalwareBazaar
TLSH 64542A7D2B88B902F73D5D3289D1166122F295834E12CB0F6EC45BEC7F5B7CA284A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1Y0M4hLHkT-R3pLNNOdKfpSff4ZwnypLp

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-29 22:35:27 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=humiuckfnansrywcrhpczavlhjp5p4k2ss4tks3c6caiibwvdnla._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
17bbea6ca05282ea03942ee0ace1d10acaa2fe617623e552e650079bf6586d11
AgentTesla
2b115e42d37b2c740cf134413b64a79dd1486a08766d0d53a1fa70c9066163a3
AgentTesla
342cb45a17253c6e1a88c20c3705beabc62c44844285d499f4be6eabf9720034
AgentTesla
7f547a386bca141205b0b5ce1d37c2de284b25988c8dc693ded6e10232251626
AgentTesla
bc15b59bbfc3e94347809a2bb9f8fbcc1982b2ef982635d6bb1d9a7be1cafbf4
AgentTesla
c8a2dc2d749fb852bf24d0829a88005eef37709eb07f68ed54370128f4a57f8a
AgentTesla
dc5aa227079d5f33af016f3160e4f33994aa9fece3d7d7eed3fb09c8c8271b7e
AgentTesla
e61849ceab8d8e5f3a9c09117c9af1e1e3c52d522476fc0698d9eac60e439002
AgentTesla
e6f24dc63903a62c11b31f12fdf5e6c71d434782963b51e3e25a9267d4004949
AgentTesla
f2abbd01987b34730d5015c22ac975e303307ae54cde7128c091827c44e7d140
AgentTesla
+ 10'535 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

615bf9fca338afb3a5e401f285cc055bb6a1e9b3e20476f199d2f102cf83819b

AgentTesla

Executable exe 3d188a0945681b28e2c289de2c82ab3a5fd7f15a94b9354b62f0808406d51b56

(this sample)

  
Dropped by
MD5 b5b6fabd7df7177a9f32f134905bf465
  
Dropped by
MD5 8c967351cf31bbf49471710a65a1d30f
  
Dropped by
GuLoader
  
Dropped by
SHA256 615bf9fca338afb3a5e401f285cc055bb6a1e9b3e20476f199d2f102cf83819b
  
Dropped by
SHA256 bcc8b067f6f57863f2b3b3d569c6ca4ae8a0a1bac9e44df7b30079ae2a8814ce
  
URLhaus
https://urlhaus.abuse.ch/url/331997/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments