MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ad5058e7337cc09bca5837f26cf6b61bdccdfecdae0dcb97cbe324a2d5a7275. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ad5058e7337cc09bca5837f26cf6b61bdccdfecdae0dcb97cbe324a2d5a7275
SHA3-384 hash: fbf8779fb0de3232b4f490e55942915bde4f9082eca005a780dfcae6062fe276b502673774279efaa7dedb3e017916a3
SHA1 hash: 57317048b31687b7287e0c2fa06079be9ee3c530
MD5 hash: deafb3bb7ce9ceb151b0a2427be81614
humanhash: quebec-apart-butter-skylark
File name:4617dc2bd56dca244ae93477109bdc9b.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:288'256 bytes
First seen:2020-03-26 15:42:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'856 x AgentTesla, 19'783 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 6144:jgrxZQWCDQBzSOPHWAHZKwR8sl3OMh0uPkgoAijnKQWsFbP:2QWCDQBm8R8spt5kgoAM
Threatray 10'570 similar samples on MalwareBazaar
TLSH D854195DAB88B901F33E1D36C1DA926017B1D5835912C34F6EC44FFA7E623CA394D29A
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1LQnFdCgfMEWsSqYC2XP3xhXkmoyMF-WZ

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 16:36:47 UTC
File Type:
PE (.Net Exe)
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nlkqldttg7gatpffqn7snt3lmg64zx7m3lqnzol4xyzeulk2oj2q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
464be33bec927be20a7a20445cf668ccb3ec05e76695ce7980b5e6841a02c0f6
AgentTesla
543e4bbc8444271fb08a6ee12c5ebd5638e95d51d85a63eee6ecd4f54b14dc92
AgentTesla
6d2a192146876a4cbd53960fa55a8fe002e2280ef94642f880980dcb9eb7f5b4
AgentTesla
6fac6128af0c87fc3022f05b3ba5e1734ca7f256281e077817ddbac2720841bb
AgentTesla
87f94a2fca72d8b4a2317257b3333d415ea4a9f28ac1470967f7b30e775030c2
AgentTesla
91b0b26682dd9be054ce4fd2eefebc1d10157ea0f08c29d3bee695453b8d7ca6
AgentTesla
b0cd91c32f6b9cca78cc162d1967e47de491d55b928a5e6538a104249d523f7e
AgentTesla
b3850a4a20e894c6b6510b89e84a93c91e48db0a5ae667c913ed212090308c8c
AgentTesla
ce8f5364bad46347efa450b4ddbb7d5a6e99a4619cc132dffe2f9878465db19e
AgentTesla
ffe9d4ee82fe122316666879b540fc2f0525bf20408f891076175c43913f4fb7
AgentTesla
+ 10'560 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

a38f1b65972aa8879866b80d722dfe009ca10cb051da37395e8cd6523217e4a7

AgentTesla

Executable exe 6ad5058e7337cc09bca5837f26cf6b61bdccdfecdae0dcb97cbe324a2d5a7275

(this sample)

  
Dropped by
MD5 4617dc2bd56dca244ae93477109bdc9b
  
Dropped by
MD5 49a58f6bdfcae267f4b5247381d9014f
  
Dropped by
GuLoader
  
Dropped by
SHA256 a38f1b65972aa8879866b80d722dfe009ca10cb051da37395e8cd6523217e4a7
  
Dropped by
SHA256 635a30629c23f91b5b7cfd5ed4c362ad402e5ffa43aa8f6b926485aa666b1669
  
URLhaus
https://urlhaus.abuse.ch/url/328904/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments