MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74b7876ae940cfe7fa98613dbfc8dd076255a2457b5656aad8d7a8f41b75988d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74b7876ae940cfe7fa98613dbfc8dd076255a2457b5656aad8d7a8f41b75988d
SHA3-384 hash: b052c557b71c6678a98cbc90282b2a56c7054317b2bec0658cf4d68667ec3751e7beda96ed2b5199ffb47a0fa0b249e3
SHA1 hash: b54e03cb1bc1d10ceb09cd63128c2d5db9b1d82d
MD5 hash: f8523b1d7bddf2d2b1804b34dc29c5ea
humanhash: pip-moon-alabama-cola
File name:5faf81cdb1ad6fefbe90c7db1bfcfbed.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'032 bytes
First seen:2020-04-01 05:45:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:y59d92R1RArt3Rnn3L6nIeZAoPR7+odjbFxNedosjbtoWT7:Q2JAJcIeOQFd1xK9oWT7
Threatray 10'584 similar samples on MalwareBazaar
TLSH ED54297C6B88FA02F63D593249E1266062F194834D12CB4F6EC41FFD7F6A7C9680A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1fI0PSeUPmnISNVmYXCzByStmpFsKx3_F

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 06:35:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=os3yo2xjidh6p6uyme637sg5a5rflisfpnlfnkwy26upig3vtcgq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
14398bfc190fd257ba1258fd5c9bb08b80a7c386d4a96dab18927d9cd22fce3a
AgentTesla
2c6aa8d5fd233661b6d8c0130af1a0c63539aae4c05fb03d74859ebeec3b7cc6
AgentTesla
83e53d7cb2f1c24c0d05496ef742d8e8584efc8261e4f915919c0029b35d2793
AgentTesla
bbff8963c1d1069fcc4f65429d480df9963765f29865e9b35a6cb100f8005754
AgentTesla
c5a9072cc171b4f49e0b4f876e5e63a2eac3579238eff1219c2a03db6e256845
AgentTesla
cf7a6cb03e47b5305b50b5d458beebb72b77143a7d03c2fb696b9e2910002e6d
AgentTesla
d1755f406106c94316efad2b9ed15de96d167ef64bfab5da28e44e4261407e48
AgentTesla
ea2b4579502edcbf620e89086f0d701f1533ca67f5dcaec50a57fb4e8b8e46f5
AgentTesla
ecb77b0aafd61f01b0f6c843594fbccba38abc0fa1df4209d9a19296567f0e94
AgentTesla
f1c58bc5387daaca15abc7de2e134f79d9e6371474025be61d9300fbf6b8fc32
AgentTesla
+ 10'574 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

2e753bd026603997948e76a386d9ce3c399db506f05b53d602716090f0cc1dc8

AgentTesla

Executable exe 74b7876ae940cfe7fa98613dbfc8dd076255a2457b5656aad8d7a8f41b75988d

(this sample)

  
Dropped by
MD5 5faf81cdb1ad6fefbe90c7db1bfcfbed
  
Dropped by
MD5 32f706da176c5c9f28b712c89d40afbd
  
Dropped by
GuLoader
  
Dropped by
SHA256 2e753bd026603997948e76a386d9ce3c399db506f05b53d602716090f0cc1dc8
  
Dropped by
SHA256 fc8b405470644b0e875a69b6cf6a6f5a0a5ad406e287ad015cc94f0f52e6ec3c
  
URLhaus
https://urlhaus.abuse.ch/url/333246/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments