MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cd475136c164ff77b53861d74e6937d8dabe9ad01139a66a1eb91b59a56b5ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	1cd475136c164ff77b53861d74e6937d8dabe9ad01139a66a1eb91b59a56b5ba
SHA3-384 hash:	4784ef369069a0a4bd01b556aa738cfb5119dd297c308f513d4a26e09d5e28a27bf85bcbb0db357b2ea325756abd6e63
SHA1 hash:	5d93ead5c4b313e6adf54c26667ca3faa8bbc64f
MD5 hash:	3f1ef1dd98cc11a613f80bfbc728adfe
humanhash:	juliet-south-mirror-pasta
File name:	SecuriteInfo.com.Trojan.PackedNET.624.6293.24367
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'033'728 bytes
First seen:	2021-05-03 08:17:19 UTC
Last seen:	2021-05-03 09:02:38 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:IzoecRRpxcrXN9ziq+WYTl9x0zqWTqatILhu2AbHzNSPno7ZB6B/4WiQhbEMHEAS:sc/Mr32q+WYTrx0zqW8uSqSWk
Threatray	4'417 similar samples on MalwareBazaar
TLSH	5B25BE773A188B10E1B847738894D27042E1EC39E262D9193CF6BE177DB6A5DCAD14CE
Reporter	SecuriteInfoCom
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/148312/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.624.6293.24367.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/707391

Signature

.NET source code contains very large array initializations

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/1cd475136c164ff77b53861d74e6937d8dabe9ad01139a66a1eb91b59a56b5ba/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2021-05-03 01:37:18 UTC

AV detection:

16 of 47 (34.04%)

Threat level:

5/5

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

82204b8b465e6be8d42e5b715ed236e7b445d3e6c6ce9b4e9cfbab2141d3635a

AgentTesla

92bf3ff764e231a512391e73d9c843f34e60335d6fbc3bc4bb0c315d2fe2b1c1

AgentTesla

9898c37e93d4e9a054c013f34ca57c1aa9130112c9104386219f94e1125d0b97

AgentTesla

9dac9b449a08b40d560a81e5ca181800854a7c546749f4b6eaddb4baaeac49e3

AgentTesla

b0cea585c416540b6820f91a0c1cf8d8eb6776ec0cecce0709cd2c22f15f7cc3

AgentTesla

be48a66b718f94c2379453ff845e0047504573e3c0e1a9f7ab3011dab1c06b57

AgentTesla

df5e40d1e917f0bd4c424f65c8e2557d094f5eff22b4ba6f63f093333ebbb8a9

AgentTesla

ea0c07c2684522e76b64fc26318a4f6c1b94e460a8eafd920977b2ed84efb6a7

AgentTesla

f7485552ad15dd1f3dce2579b733e104dea810e8bbc1defd06fc4de935ca6a17

AgentTesla

+ 4'407 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210503-cxawzkyt2j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

bdf79e57b5574f9bafb56f6d0592f5ee429df7eb0ad536fbdb4f2956aae36f87

MD5 hash:

826b29e2a141b055a5491c9d7dc6eea7

SHA1 hash:

af4201362b8603bf7e4b6e2ead1cfb610dd7c0a9

Link:

https://www.unpac.me/results/aef2ffeb-48ee-468e-9c20-4614e2967196/

SH256 hash:

1cd475136c164ff77b53861d74e6937d8dabe9ad01139a66a1eb91b59a56b5ba

MD5 hash:

3f1ef1dd98cc11a613f80bfbc728adfe

SHA1 hash:

5d93ead5c4b313e6adf54c26667ca3faa8bbc64f

Link:

https://www.unpac.me/results/aef2ffeb-48ee-468e-9c20-4614e2967196/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1cd475136c164ff77b53861d74e6937d8dabe9ad01139a66a1eb91b59a56b5ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time