MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b19558bce7b0c7ad63de9faaae6c19ee98d48aec87072f02d290a98d6055c1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b19558bce7b0c7ad63de9faaae6c19ee98d48aec87072f02d290a98d6055c1c
SHA3-384 hash: daa01df54bbde1251aec24ec44eaee6170b063ac322da8b5b198a9985ce3e4f4f66d78f0451b2ee9c56a8e6cbaebaadc
SHA1 hash: 17ecb0568313d3951a4bfea547b804b2a815d24a
MD5 hash: 9f702f9158b6bb2b7de627adfe52a56c
humanhash: hotel-venus-red-angel
File name:11ab9b4853665fad4b1b5b357438d4f5.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:298'496 bytes
First seen:2020-03-26 20:14:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:C0qMNMNezSVARORAWAq8HiQ22h+YECDjxbVJbOUoeTV:xN68ROSJh+YLD3oeTV
Threatray 10'480 similar samples on MalwareBazaar
TLSH 87543A7D2F88BA02F63D5D3289D1266412F1D4834E12CB0F6EC81FED7E5A7C9294A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://onedrive.live.com/download?cid=B24535E108E4D261&resid=B24535E108E4D261%21134&authkey=AAWXqJY0xD-VP5g

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 20:35:36 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lmmvlc6opmghvvr55h5kvzwbt3uy2sfozbyhf4bnfefjrvqflqoa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0068cd1c85fc05f425fc6213b8317b2827528285d1a73b7df6135123161448ee
AgentTesla
09b0e2a84a8e7165c5a3b23efcd53cde0a7090e1ebe09a86cca86c33f7c39290
AgentTesla
2836e2f050c5ed948fb0652dde8eca6e867cb25aaa835d8b58738ec251dded5b
AgentTesla
3b579b5c48b467cb0e3a3b28773a63ce90b11a87f4baba15b98d0af36291a314
AgentTesla
7bc99e45681c54f07827a4beb516cf130666b26ad1244d89dcda0a3e9c983f0f
AgentTesla
8f8f28f5eee0d7e5a4bf151528beb476347dd84c94ef721675237f00e391c6f5
AgentTesla
ba3bac695a448759f82d4c5180cad7d308fdb8bc12a159456b75ead72aca9424
AgentTesla
d63ec5231d1d805fcf8272f20282fa1bd9b94cc01c309a5eaaf32c1e09f9df6c
AgentTesla
df4a4e6430488397eecf551b6f8558f71d5bc65fe78d70cde3d45e38e82d82f9
AgentTesla
e200737a203c4aa2f0dd82a3fc5fef097eb0e64b81b231b29b3022741ade5976
AgentTesla
+ 10'470 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

8ece48f539ba958b69382bc7e076a485064207747f8485f5994d16f36c3163ef

AgentTesla

Executable exe 5b19558bce7b0c7ad63de9faaae6c19ee98d48aec87072f02d290a98d6055c1c

(this sample)

  
Dropped by
MD5 11ab9b4853665fad4b1b5b357438d4f5
  
Dropped by
MD5 038e1598cddde448301462ab49a45876
  
Dropped by
GuLoader
  
Dropped by
SHA256 8ece48f539ba958b69382bc7e076a485064207747f8485f5994d16f36c3163ef
  
Dropped by
SHA256 24084e6ea6ad4e591e51af89b5ca19f96d2f5436eb2af1aad1c141dcccce93d6
  
URLhaus
https://urlhaus.abuse.ch/url/328209/
  
URLhaus
https://urlhaus.abuse.ch/url/328442/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments