MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0c6be7aa9d02dd6545c3e18913e5a89c7cb96bfe79875c1a6c4aeea632a9c9ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 8
| SHA256 hash: | 0c6be7aa9d02dd6545c3e18913e5a89c7cb96bfe79875c1a6c4aeea632a9c9ee |
|---|---|
| SHA3-384 hash: | 94d1dace0b56155e85c0c20a9779551f48624842688f0a51fc46647614d08ae1b6dfe2367c821efa85a9a5d6fd83ea1f |
| SHA1 hash: | ec16437abe4696eea2234ced91bc8f8ac6f61329 |
| MD5 hash: | 86494bc0ef5f71fa7364129fa22a9a8f |
| humanhash: | august-connecticut-uranus-spring |
| File name: | 86494bc0ef5f71fa7364129fa22a9a8f |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 221'323 bytes |
| First seen: | 2021-07-09 00:36:05 UTC |
| Last seen: | 2021-07-09 03:02:51 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6e7f9a29f2c85394521a08b9f31f6275 (277 x GuLoader, 44 x RemcosRAT, 39 x VIPKeylogger) |
| ssdeep | 3072:hDxaVzwmg4CSW8JSuQbLG5UfH+hbf+XsFzMN/SkIwx3zxLUx+u2fF5qpirjwTeeV:xMm4CCAy5Uv+5/F7ktoUD2Cbe0Sus |
| Threatray | 6'505 similar samples on MalwareBazaar |
| TLSH | T15524126477E2C67BE26304314D3D72EE99E9C61616308B4B47B1278DBC26183EB0B727 |
| Reporter |  zbetcheckin |
| Tags: | 32 AgentTesla exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
86494bc0ef5f71fa7364129fa22a9a8f
Verdict:
Malicious activity
Analysis date:
2021-07-09 00:41:29 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Antivirus detection for dropped file
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.FormBook
Status:
Malicious
First seen:
2021-07-09 00:37:06 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
5/5
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 6'495 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
f25a4296831407d00c53d627e52644d7fef83368ab9ca75df3e56f2140a83988
MD5 hash:
9a952b79f1ea4d739e35c7546841df8e
SHA1 hash:
575016994f6e67980095d4dcdbe0849380c29a18
SH256 hash:
7843398e3363be99722aad6a151ad76b6f35c8490359df42bc7ceb8ecf3f410a
MD5 hash:
9aa0362720f2aafc472a0ae2af2a8018
SHA1 hash:
387159a645f3c980c7a663d2b66bea6026fdc48b
SH256 hash:
560256e97b57b060fbae8b6a7f921a645985b3b57665275c8f63d58eb4ea25b3
MD5 hash:
2176967dad21c99347bbbdb32f1ceae4
SHA1 hash:
257408c49f3cd7d69a63b63037eed30d9c22ae8d
SH256 hash:
0c6be7aa9d02dd6545c3e18913e5a89c7cb96bfe79875c1a6c4aeea632a9c9ee
MD5 hash:
86494bc0ef5f71fa7364129fa22a9a8f
SHA1 hash:
ec16437abe4696eea2234ced91bc8f8ac6f61329
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.77
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://lifestyledrinks.hu/wp-includes/cs2/startuppp.exe