MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5ed24617a8781237722d5368eadc312568dc08fd92c666a4441e6d4a714dea3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5ed24617a8781237722d5368eadc312568dc08fd92c666a4441e6d4a714dea3
SHA3-384 hash: d5b9f097c5e9afad7552c34011f9289ef51bcaea69913a2ed924237a005e16747b8e9444e9be5f46a5bbc11b63f93b60
SHA1 hash: 54b3dead533d8a4b7d9a12f21053ddfb1dbcf2c8
MD5 hash: 289cdcfb4f1c40ddfa19ff63a0086ca9
humanhash: delta-fillet-july-wolfram
File name:6117bfd2adcabdfe879b85d9fa0855fc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'032 bytes
First seen:2020-04-05 19:35:11 UTC
Last seen:2020-04-08 14:20:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:WdrBftVXRb4JLT1bcArpAYWqL50xo3glRqVdyfGyb:IxRb4JLpbnrERRE
Threatray 10'588 similar samples on MalwareBazaar
TLSH 115419BC2B88B902F63D0D3389D1266162F195834D22CB0F6EC45BFD7B567C9294A3A5
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=15vd8iYwNX_Ax7PYjYl1aM-OTiPjNBVqx

Intelligence

File Origin
# of uploads :
3
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-05 20:35:50 UTC
File Type:
PE (.Net Exe)
AV detection:
23 of 30 (76.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yxwsiyl2q6asg5zc2u3i5lodcjli3qep3ewgm2seihtnjjyu32rq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0f3fe234c700b316a460c05098c843efbb0965b672d0e7a6f58028669c37ccb9
AgentTesla
2a3b5f4a6e6d41c86a9d25ff46831b1bcf73db123bf659d59c8125c147afc895
AgentTesla
399a8e11367c80009a8cd861c379e0f4d6feff8544fecf51705a474edb3b624e
AgentTesla
3be0077c6f64fbd2d0e432bc48a369f17242ba95e26c36bde1ef5c7cc4940b05
AgentTesla
40bd3914235bbb167ad733ba737282f760f57b94a6c98eaed0c9b2aaa66c4627
AgentTesla
552b5befe919abe88a18e7cd4e82de23c584309a7aa9924f3376f33a8e86a635
AgentTesla
5dedf1d8fe82e6567b41fabe389d1bbedd14a6532320abab390f852bcc8bcce3
AgentTesla
69ae33d3de4e9ab0200a9c58cde93a8413d35b92116ce40595af0840eaa56952
AgentTesla
b01594842e3d5d79f262899e0eb357ea538a3f96145b77f102b4ea0ae531c3c6
AgentTesla
b7d481a9846e10a27165c873afc35307088f02b5c1c4e253e35e0dd5f6a7034f
AgentTesla
+ 10'578 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

20d97b53712cacad99d47d0385cc1fe0355887041fe0f274b90432067ffb782a

AgentTesla

Executable exe c5ed24617a8781237722d5368eadc312568dc08fd92c666a4441e6d4a714dea3

(this sample)

  
Dropped by
MD5 6117bfd2adcabdfe879b85d9fa0855fc
  
Dropped by
MD5 9cd5ff16110ff980062e68f671273772
  
Dropped by
GuLoader
  
Dropped by
SHA256 20d97b53712cacad99d47d0385cc1fe0355887041fe0f274b90432067ffb782a
  
Dropped by
SHA256 2f23bc41433bc7b5e27b57d0e5e5ef4fc3ed9f9e0bcbd56cac3841fddd410774
  
URLhaus
https://urlhaus.abuse.ch/url/335634/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments