MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c88e64fa65839e26939ab7701755252b7f24b8e65164dd88acae735c30e4fc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	1c88e64fa65839e26939ab7701755252b7f24b8e65164dd88acae735c30e4fc4
SHA3-384 hash:	78648b7ff10b1a4be8b3f4a2822202f2f962f6c3a23adfff9de0059c586f897e0b6c447c6c612d4de7363c1f5451d43a
SHA1 hash:	8a9079d9ad2d9d0826b2c5361ccdc0688af55067
MD5 hash:	eb6a172979202b7f53d315e625d8113e
humanhash:	blue-wisconsin-iowa-steak
File name:	payment advice.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	784'896 bytes
First seen:	2022-02-03 07:59:44 UTC
Last seen:	2022-02-03 10:26:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'481 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:d+lfTQoOyocDQkjdh0BaTyG+fx3cKWb8jX0HBuTdwqWqd2TEn+FQ6mLvehxjVP0N:d2r8bSQGgAQxKb8jX0HaeqWTE+FPmLe4
Threatray	14'233 similar samples on MalwareBazaar
TLSH	T1BEF46BBC312075EFC9ABC431DB681DA8EE506C7B930B5667901771AD996CA87CF201B3
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/231727/

Detection(s):

SecuriteInfo.com.Trojan.Siggen16.39318.5968.4092.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Сreating synchronization primitives

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/61fb8b94a0f6a794b3364cd5/reports/fd068bb5-056e-428d-84f0-720219e60523/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/caff7b36-3ab7-4519-985b-a0b08da5e89b

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.adwa.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/933701

Behaviour

Behavior Graph:

n/a

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/1c88e64fa65839e26939ab7701755252b7f24b8e65164dd88acae735c30e4fc4/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-02-03 01:03:39 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 28 (82.14%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dseomt5gla46e2jzvn3qc5kskk37es4omule3wekzlttlqyoj7ca._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

40dd6398341ceb6f2383b768c51003bbd5f5003850ce7f7a4b37701349376b7e

AgentTesla

6529c08aa108399edf5f1309fe6d9a56fc484c30cad0ff80c9e0fb0f01cb545e

AgentTesla

72c29cc8f992bf2e6737c00a9e9e83c8e856156a61169d9f0cfeedf4307d1805

AgentTesla

77b1b18af3059f27404d563875a95b76ac6209af840ea336f6bc5e239766ba6b

AgentTesla

783be273ace4a3660a69573931e293f5b5d36eff51d71033aec25209cbac8c1d

AgentTesla

eaa778e836807d3c7dc4198eb7b0aec0d7de4a11ab1e2b6764b17ac0fd907afd

AgentTesla

+ 14'223 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/220203-jv21gaeee5/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Suspicious use of SetThreadContext

Sets service image path in registry

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

d6a5ca9134df9ce8a24766ce35fe6062c97aba5cefe3a339038d503917ffd13c

MD5 hash:

cfe430621a3da879176f061b1a8e736e

SHA1 hash:

d19b05960d1dcb4dee103d494c1c367031afeab9

Link:

https://www.unpac.me/results/dd6eda59-72d1-4a58-8592-4ff749d775cc/

SH256 hash:

093f4efe302547161dc010d1df538a0db5c300c616f73620e50a615d250b0efb

MD5 hash:

0b89ef2ac19303ed31e5351640c0d3d1

SHA1 hash:

55d27c6751937ac1c1dece2c06c2f1a9b79dc4ad

Link:

https://www.unpac.me/results/dd6eda59-72d1-4a58-8592-4ff749d775cc/

SH256 hash:

79823e47436e129def4fba8ee225347a05b7bb27477fb1cc8be6dc9e9ce75696

MD5 hash:

39f524c1ab0eb76dfd79b2852e5e8c39

SHA1 hash:

428018e1701006744e34480b0029982a76d8a57d

Link:

https://www.unpac.me/results/dd6eda59-72d1-4a58-8592-4ff749d775cc/

SH256 hash:

1c88e64fa65839e26939ab7701755252b7f24b8e65164dd88acae735c30e4fc4

MD5 hash:

eb6a172979202b7f53d315e625d8113e

SHA1 hash:

8a9079d9ad2d9d0826b2c5361ccdc0688af55067

Link:

https://www.unpac.me/results/dd6eda59-72d1-4a58-8592-4ff749d775cc/

Malware family:

Agent Tesla v3

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/1c88e64fa658/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/1c88e64fa65839e26939ab7701755252b7f24b8e65164dd88acae735c30e4fc4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.