MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a7019b306bf4279968ec47d5a339d654508a8547030b616befefc5bc75df992. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a7019b306bf4279968ec47d5a339d654508a8547030b616befefc5bc75df992
SHA3-384 hash: f0f0090ec1b72255df819a11577157838ae4280593a3e4e877f8e8e13a0e6cc6f558555f9dbe0b8d6069e7c56cdab6ea
SHA1 hash: aff56957338e6964a066fcb987ba6590badbf25b
MD5 hash: b96f3086e301fe682f39ae181994212c
humanhash: alanine-december-fruit-black
File name:553e17fc7bece1ed7b9c58d5b3fad671.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'520 bytes
First seen:2020-04-08 09:24:35 UTC
Last seen:2020-04-09 16:55:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'655 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 6144:ANt0/UMtZkQnaTQhEWCUeZbhfCb9GWuuQKAd4xbNoaTV:AE/rknWCJ88WBQKNoaTV
Threatray 10'708 similar samples on MalwareBazaar
TLSH 86543B7D2B88B902FB3D5D3289D1666022F194834D22CB4F6EC41EED7F637C9294A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1BM4PVk1sgYNYNZNjlBX3BYLYpN_76aaa

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-08 09:35:21 UTC
File Type:
PE (.Net Exe)
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ljybtmygx5bhtfuoyr6vum45mvcqrkcuoaylmfv6736fxr257gja._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0702729c34578ee78cf3cb883ee298fc4aa67dbb433981790605e4e4afb642ff
AgentTesla
1304ed05b8f1d183feec8852f16c1f0ba3198388f437a339af62bd2974d8ebdb
AgentTesla
1e68055f95563948fbacfd1de0b04fd457c108ef8482d2a6642a0067835ce529
AgentTesla
37f3611503d3e8828f5acc568dc065e4fadc60558d1812d3473140d21146c0b4
AgentTesla
4a2c1f3c1df5c34f1c99c8f7cc8b18fae2c71189e6e383face3ff7fa31224f52
AgentTesla
4fba937f1e8ae7eab73de2233f36e813fc2e4e889cbf5103f72ed642ba2e76c3
AgentTesla
6af32b6b849f1186317e65f84c1d59cc03ce878ca8e3706c5d7afae2389b3c64
AgentTesla
a67bb928f2d8830e5e8dd05beec8d56d189af490a667522752cba64b6cd5951a
AgentTesla
b8cf49555f75f9f06bdfb76150d4b3e1a01a831a7eac7b644dde084c212a43d2
AgentTesla
f35fa2a6281a2a24016729d315083a638edf176a890a605dba2ac134e1733bb3
AgentTesla
+ 10'698 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj cb6ad7c370e35d73f533e06f833270f183bc1c058d19c15e42d51601a7d94010

GuLoader

Executable exe 0daa29b9c74872bfe69ee54537140e75c43b9227c45d6d202df200d6f3ebeccd

AgentTesla

Executable exe 5a7019b306bf4279968ec47d5a339d654508a8547030b616befefc5bc75df992

(this sample)

  
Dropped by
MD5 553e17fc7bece1ed7b9c58d5b3fad671
  
Dropped by
MD5 e11ee4e624b8180399d5ee2a191cf33c
  
Dropped by
GuLoader
  
Dropped by
SHA256 0daa29b9c74872bfe69ee54537140e75c43b9227c45d6d202df200d6f3ebeccd
  
Dropped by
SHA256 de9a7c5d9600fec87ab31454eca6cd2da23b63b98e6b62c297eb6085482ff5e5
  
URLhaus
https://urlhaus.abuse.ch/url/336707/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments