MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd75215808d3f28bc56edc497c186d2b53d175467b9d4aa3f525843c51ceb39b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd75215808d3f28bc56edc497c186d2b53d175467b9d4aa3f525843c51ceb39b
SHA3-384 hash: 7ecf27eb13449b8c5e12a20089882f0eb730c68de82b5c556b99a9c50e9ecabf31922f5c8da82f9d5f9059fe489b1f94
SHA1 hash: 2f7fbd3f2d8465fff78bedff47985dcddc85788c
MD5 hash: 3dc117f667b5f9585f18629caa9bf010
humanhash: india-burger-sad-three
File name:31ea8287c22a3cc734a430772e5657df.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:294'400 bytes
First seen:2020-03-30 13:35:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'656 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 6144:k5pTf91/nsalewucN0+MDQCw7ETt6vDwJx/bRmGTV:W1/svpm0IvDcVmGTV
Threatray 10'447 similar samples on MalwareBazaar
TLSH 4554297C2B88B902F67D193789D17670A2F194834D22CB0F6EC41BFD7B527C9294A3A5
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1R51BtBfJWaHhKsmH0GXqztZg2twXtT7z

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 14:35:30 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zv2scwai2pzixrlo3rexygdnfnj5c5kgpoouvi7vewcdyuoowonq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0068cd1c85fc05f425fc6213b8317b2827528285d1a73b7df6135123161448ee
AgentTesla
20a94eccb531b9e7db7c2f15b4b02661781688b26407d8cad53ed9c3e1b16f88
AgentTesla
2d7e2c50d9fde2f20a360d73ec3545f50cff138d0ddaf14ae3833034fd7f2f9f
AgentTesla
543e4bbc8444271fb08a6ee12c5ebd5638e95d51d85a63eee6ecd4f54b14dc92
AgentTesla
6e077f8a754b865c8322b86fd21be4c9f6e013e0deed9003671c624033795cf0
AgentTesla
8cf4d562d03815786cbd7e0fb3c18e5f7e257a216cb833b7e949a2c189ea79b4
AgentTesla
8e8cfe9188831a51fa67ebaee3966067a035b8e612c1ad6cd3a281f716f7e9bf
AgentTesla
a00f64383ecb01c22889105016ebd58705accad3eea15a189a5804b7c27a0e79
AgentTesla
d7b59d350dd16d5c6a39706ba5dade34574798379ac54f0fa0cbea42158435ac
AgentTesla
e9c66deea17bd72dd008c96d6ef671faa5ee2319f541100557093cff0bdc0dc7
AgentTesla
+ 10'437 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

GuLoader

Executable exe 3be4f95709bd751f894af6489da8c700cb5d6bcdf5f33dadfcdb29ae53f7549b

AgentTesla

Executable exe cd75215808d3f28bc56edc497c186d2b53d175467b9d4aa3f525843c51ceb39b

(this sample)

  
Dropped by
MD5 31ea8287c22a3cc734a430772e5657df
  
Dropped by
MD5 f41c1c2a906eaf02e17165f84e88639f
  
Dropped by
GuLoader
  
Dropped by
SHA256 3be4f95709bd751f894af6489da8c700cb5d6bcdf5f33dadfcdb29ae53f7549b
  
Dropped by
SHA256 9a5211c86db1ba43af3fb038fb2cdc9750154d3e9e40d2163867291509a6058d
  
URLhaus
https://urlhaus.abuse.ch/url/332208/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments