MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2177882a8fb4bd06c84f61e81cb2fdf862e88f0a86b66a10faa88801696422cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 4 File information Comments

SHA256 hash:	2177882a8fb4bd06c84f61e81cb2fdf862e88f0a86b66a10faa88801696422cd
SHA3-384 hash:	c6b979e7ea9631835f44fb2a12c92d973e726d178a0c2b79f515613237202049893f67915a35b5e3d7243c92612deb72
SHA1 hash:	fdefb6aedf90140e433d332cf2663f592da8efaf
MD5 hash:	44ba0e88119dec1d2a906ee29e7d20f0
humanhash:	lactose-orange-finch-echo
File name:	SecuriteInfo.com.Win32.Malware-gen.14284.31114
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	3'481'568 bytes
First seen:	2023-06-26 13:31:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	49152:3jLGkMxAQKsbEQvgRVF3n7jQe7wqRWxXXrTNs:3nGbxWsADQe7wqU3e
Threatray	4'102 similar samples on MalwareBazaar
TLSH	T1ECF5D447B6978FB2D3491736C59797232BEED6C13723D60E2E8A136A19C37B69C44203
TrID	63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	f4787814246458e4 (1 x AgentTesla)
Reporter	SecuriteInfoCom
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

290

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

SecuriteInfo.com.Win32.Malware-gen.14284.31114

Verdict:

Malicious activity

Analysis date:

2023-06-26 13:31:46 UTC

Tags:

agenttesla

Link:

https://app.any.run/tasks/541dca2f-92e9-4737-ac53-ee2fa0351727

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/402982/

Detection(s):

SecuriteInfo.com.Win32.Malware-gen.14284.31114.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a file in the %temp% directory

Сreating synchronization primitives

Creating a process from a recently created file

Creating a file in the %AppData% directory

Creating a file

Using the Windows Management Instrumentation requests

Launching a process

Creating a window

Searching for synchronization primitives

DNS request

Launching the default Windows debugger (dwwin.exe)

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/64999353aa4a3df2d52170b9/reports/371ba8e2-3283-4a5f-b126-e1859a8e50c2/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/2177882a8fb4bd06c84f61e81cb2fdf862e88f0a86b66a10faa88801696422cd

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1107d621-b8c4-486b-874f-dde501a178e1

Result

Threat name:

AgentTesla, Clipboard Hijacker

Detection:

malicious

Classification:

spre.troj.adwa.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1261479

Signature

.NET source code contains potential unpacker

Antivirus detection for dropped file

Bypasses PowerShell execution policy

Creates an autostart registry key pointing to binary in C:\Windows

Creates multiple autostart registry keys

Drops PE files to the startup folder

Found malware configuration

Injects a PE file into a foreign processes

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Powershell drops PE file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Copy file to startup via Powershell

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected Clipboard Hijacker

Yara detected Costura Assembly Loader

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/2177882a8fb4bd06c84f61e81cb2fdf862e88f0a86b66a10faa88801696422cd/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2023-06-26 09:17:51 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ef3yqkupws6qnscpmhubzmx57brordykq23gueh2vceac2leelgq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

0a6e9968b41ff6c4c5dc632a22de371cc50b208db9dde57c562a69b47b3f479e

AgentTesla

1a6889803b766ce102a10973126f946e3618a0f80c1cee6d902304d2ffae06c5

AgentTesla

3520f6322123eacd232b1dd107d892e852aa8cfa79eaf4fc3fb9c5b23893c948

AgentTesla

511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730

AgentTesla

5404c10cf88a5d915b78fcc822cb3ba3139ad4ed9cdacbf6c82dd070c4e1bc4b

AgentTesla

5d0e89e4891c61e170a328bdfd4205904de058eb335857e9cb08660871ee6e7e

AgentTesla

6c5181c0a6838d1afcd5e9f3730c0559a1934dc775ed5b316ef2745d68f5bfa1

AgentTesla

e2a4e3661a1ba5c88dbfcb792f0d489b37f14f74f2d1b2111a278bc81fb930c7

AgentTesla

+ 4'092 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230626-qsyctshh72/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

b16d8608c5cb7ba80e03c88e50ee2d5c54ec484ef5b58086a7d67314a96d5ba0

MD5 hash:

1c4b2ffec960d4ce94493d1d9838e68a

SHA1 hash:

8fcd0040f89e5bbe18a690520ec642e2ea120385

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

37489bcc25f8e5c1c5cef29bda5deed746f9311ed0237f91e7004a401591edb4

MD5 hash:

e359b633026653ad8db27f633bddaca6

SHA1 hash:

7303034c185d48693b52f8566921018c2161d1da

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

7147369c734d0852c5a9f01ab59e1c82b4bb1a6a32df8981a1ea83d01388bfe6

MD5 hash:

d81fd532e45963f3005e05740692318d

SHA1 hash:

0f20a5b845e8d0abc22a20ed3bd1d51a206f760e

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

3b9e0faed2481cfffc15a092e8a86ea42b94ee75586273494f2d42affa2edb37

MD5 hash:

183059b7b0be8f6cd5a2429b97474a23

SHA1 hash:

f1c748e2baed4d722627b8adf7dc4e1a65f45f37

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

519762889657a5dbf4e7f2e77f893fad50441c4d217d5734d3ab68448372f6a4

MD5 hash:

1df31e666d0234e7d2e17f46cfeed5f6

SHA1 hash:

81d06e1a1dfbc7dd2993ff6fc371bfd6ca00df0f

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

17f4acafa41b6edc5f1a8852de796325eefbfebe950c91cc17a148042704675d

MD5 hash:

a8a87fc0463188d6a3b244cd79d5da6c

SHA1 hash:

370f1bc0f6a7f73e79226a676981c4ce118e0317

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

df0d2460550bf4951ac61b260fb8dac5328b2ba737f48ed454ce9da7f7fa223b

MD5 hash:

b075814eed9a2bccae06cd2d9f9a937a

SHA1 hash:

2c33c6b8232d0d80305489c04c519d8e925b9b5b

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Parent samples :

6c5181c0a6838d1afcd5e9f3730c0559a1934dc775ed5b316ef2745d68f5bfa1
0a6e9968b41ff6c4c5dc632a22de371cc50b208db9dde57c562a69b47b3f479e
5d0e89e4891c61e170a328bdfd4205904de058eb335857e9cb08660871ee6e7e
2177882a8fb4bd06c84f61e81cb2fdf862e88f0a86b66a10faa88801696422cd
177fdeb986dfc47c2ad514969947afdfbbe8e9243b720581c40e27ee1a9cd812
69763f4eedc0fbd3cde4485cbcc940105536015254891a53c18b7364f8aa30df

SH256 hash:

b16d8608c5cb7ba80e03c88e50ee2d5c54ec484ef5b58086a7d67314a96d5ba0

MD5 hash:

1c4b2ffec960d4ce94493d1d9838e68a

SHA1 hash:

8fcd0040f89e5bbe18a690520ec642e2ea120385

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

37489bcc25f8e5c1c5cef29bda5deed746f9311ed0237f91e7004a401591edb4

MD5 hash:

e359b633026653ad8db27f633bddaca6

SHA1 hash:

7303034c185d48693b52f8566921018c2161d1da

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

b16d8608c5cb7ba80e03c88e50ee2d5c54ec484ef5b58086a7d67314a96d5ba0

MD5 hash:

1c4b2ffec960d4ce94493d1d9838e68a

SHA1 hash:

8fcd0040f89e5bbe18a690520ec642e2ea120385

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

7147369c734d0852c5a9f01ab59e1c82b4bb1a6a32df8981a1ea83d01388bfe6

MD5 hash:

d81fd532e45963f3005e05740692318d

SHA1 hash:

0f20a5b845e8d0abc22a20ed3bd1d51a206f760e

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

37489bcc25f8e5c1c5cef29bda5deed746f9311ed0237f91e7004a401591edb4

MD5 hash:

e359b633026653ad8db27f633bddaca6

SHA1 hash:

7303034c185d48693b52f8566921018c2161d1da

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

3b9e0faed2481cfffc15a092e8a86ea42b94ee75586273494f2d42affa2edb37

MD5 hash:

183059b7b0be8f6cd5a2429b97474a23

SHA1 hash:

f1c748e2baed4d722627b8adf7dc4e1a65f45f37

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

7147369c734d0852c5a9f01ab59e1c82b4bb1a6a32df8981a1ea83d01388bfe6

MD5 hash:

d81fd532e45963f3005e05740692318d

SHA1 hash:

0f20a5b845e8d0abc22a20ed3bd1d51a206f760e

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

519762889657a5dbf4e7f2e77f893fad50441c4d217d5734d3ab68448372f6a4

MD5 hash:

1df31e666d0234e7d2e17f46cfeed5f6

SHA1 hash:

81d06e1a1dfbc7dd2993ff6fc371bfd6ca00df0f

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

3b9e0faed2481cfffc15a092e8a86ea42b94ee75586273494f2d42affa2edb37

MD5 hash:

183059b7b0be8f6cd5a2429b97474a23

SHA1 hash:

f1c748e2baed4d722627b8adf7dc4e1a65f45f37

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

519762889657a5dbf4e7f2e77f893fad50441c4d217d5734d3ab68448372f6a4

MD5 hash:

1df31e666d0234e7d2e17f46cfeed5f6

SHA1 hash:

81d06e1a1dfbc7dd2993ff6fc371bfd6ca00df0f

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

17f4acafa41b6edc5f1a8852de796325eefbfebe950c91cc17a148042704675d

MD5 hash:

a8a87fc0463188d6a3b244cd79d5da6c

SHA1 hash:

370f1bc0f6a7f73e79226a676981c4ce118e0317

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

b16d8608c5cb7ba80e03c88e50ee2d5c54ec484ef5b58086a7d67314a96d5ba0

MD5 hash:

1c4b2ffec960d4ce94493d1d9838e68a

SHA1 hash:

8fcd0040f89e5bbe18a690520ec642e2ea120385

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

df0d2460550bf4951ac61b260fb8dac5328b2ba737f48ed454ce9da7f7fa223b

MD5 hash:

b075814eed9a2bccae06cd2d9f9a937a

SHA1 hash:

2c33c6b8232d0d80305489c04c519d8e925b9b5b

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Parent samples :

SH256 hash:

37489bcc25f8e5c1c5cef29bda5deed746f9311ed0237f91e7004a401591edb4

MD5 hash:

e359b633026653ad8db27f633bddaca6

SHA1 hash:

7303034c185d48693b52f8566921018c2161d1da

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

17f4acafa41b6edc5f1a8852de796325eefbfebe950c91cc17a148042704675d

MD5 hash:

a8a87fc0463188d6a3b244cd79d5da6c

SHA1 hash:

370f1bc0f6a7f73e79226a676981c4ce118e0317

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

7147369c734d0852c5a9f01ab59e1c82b4bb1a6a32df8981a1ea83d01388bfe6

MD5 hash:

d81fd532e45963f3005e05740692318d

SHA1 hash:

0f20a5b845e8d0abc22a20ed3bd1d51a206f760e

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

df0d2460550bf4951ac61b260fb8dac5328b2ba737f48ed454ce9da7f7fa223b

MD5 hash:

b075814eed9a2bccae06cd2d9f9a937a

SHA1 hash:

2c33c6b8232d0d80305489c04c519d8e925b9b5b

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Parent samples :

SH256 hash:

3b9e0faed2481cfffc15a092e8a86ea42b94ee75586273494f2d42affa2edb37

MD5 hash:

183059b7b0be8f6cd5a2429b97474a23

SHA1 hash:

f1c748e2baed4d722627b8adf7dc4e1a65f45f37

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

b16d8608c5cb7ba80e03c88e50ee2d5c54ec484ef5b58086a7d67314a96d5ba0

MD5 hash:

1c4b2ffec960d4ce94493d1d9838e68a

SHA1 hash:

8fcd0040f89e5bbe18a690520ec642e2ea120385

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

519762889657a5dbf4e7f2e77f893fad50441c4d217d5734d3ab68448372f6a4

MD5 hash:

1df31e666d0234e7d2e17f46cfeed5f6

SHA1 hash:

81d06e1a1dfbc7dd2993ff6fc371bfd6ca00df0f

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

37489bcc25f8e5c1c5cef29bda5deed746f9311ed0237f91e7004a401591edb4

MD5 hash:

e359b633026653ad8db27f633bddaca6

SHA1 hash:

7303034c185d48693b52f8566921018c2161d1da

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

7147369c734d0852c5a9f01ab59e1c82b4bb1a6a32df8981a1ea83d01388bfe6

MD5 hash:

d81fd532e45963f3005e05740692318d

SHA1 hash:

0f20a5b845e8d0abc22a20ed3bd1d51a206f760e

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

17f4acafa41b6edc5f1a8852de796325eefbfebe950c91cc17a148042704675d

MD5 hash:

a8a87fc0463188d6a3b244cd79d5da6c

SHA1 hash:

370f1bc0f6a7f73e79226a676981c4ce118e0317

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

3b9e0faed2481cfffc15a092e8a86ea42b94ee75586273494f2d42affa2edb37

MD5 hash:

183059b7b0be8f6cd5a2429b97474a23

SHA1 hash:

f1c748e2baed4d722627b8adf7dc4e1a65f45f37

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

df0d2460550bf4951ac61b260fb8dac5328b2ba737f48ed454ce9da7f7fa223b

MD5 hash:

b075814eed9a2bccae06cd2d9f9a937a

SHA1 hash:

2c33c6b8232d0d80305489c04c519d8e925b9b5b

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Parent samples :

SH256 hash:

519762889657a5dbf4e7f2e77f893fad50441c4d217d5734d3ab68448372f6a4

MD5 hash:

1df31e666d0234e7d2e17f46cfeed5f6

SHA1 hash:

81d06e1a1dfbc7dd2993ff6fc371bfd6ca00df0f

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

b16d8608c5cb7ba80e03c88e50ee2d5c54ec484ef5b58086a7d67314a96d5ba0

MD5 hash:

1c4b2ffec960d4ce94493d1d9838e68a

SHA1 hash:

8fcd0040f89e5bbe18a690520ec642e2ea120385

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

17f4acafa41b6edc5f1a8852de796325eefbfebe950c91cc17a148042704675d

MD5 hash:

a8a87fc0463188d6a3b244cd79d5da6c

SHA1 hash:

370f1bc0f6a7f73e79226a676981c4ce118e0317

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

37489bcc25f8e5c1c5cef29bda5deed746f9311ed0237f91e7004a401591edb4

MD5 hash:

e359b633026653ad8db27f633bddaca6

SHA1 hash:

7303034c185d48693b52f8566921018c2161d1da

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

df0d2460550bf4951ac61b260fb8dac5328b2ba737f48ed454ce9da7f7fa223b

MD5 hash:

b075814eed9a2bccae06cd2d9f9a937a

SHA1 hash:

2c33c6b8232d0d80305489c04c519d8e925b9b5b

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Parent samples :

SH256 hash:

7147369c734d0852c5a9f01ab59e1c82b4bb1a6a32df8981a1ea83d01388bfe6

MD5 hash:

d81fd532e45963f3005e05740692318d

SHA1 hash:

0f20a5b845e8d0abc22a20ed3bd1d51a206f760e

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

3b9e0faed2481cfffc15a092e8a86ea42b94ee75586273494f2d42affa2edb37

MD5 hash:

183059b7b0be8f6cd5a2429b97474a23

SHA1 hash:

f1c748e2baed4d722627b8adf7dc4e1a65f45f37

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

b16d8608c5cb7ba80e03c88e50ee2d5c54ec484ef5b58086a7d67314a96d5ba0

MD5 hash:

1c4b2ffec960d4ce94493d1d9838e68a

SHA1 hash:

8fcd0040f89e5bbe18a690520ec642e2ea120385

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

37489bcc25f8e5c1c5cef29bda5deed746f9311ed0237f91e7004a401591edb4

MD5 hash:

e359b633026653ad8db27f633bddaca6

SHA1 hash:

7303034c185d48693b52f8566921018c2161d1da

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

519762889657a5dbf4e7f2e77f893fad50441c4d217d5734d3ab68448372f6a4

MD5 hash:

1df31e666d0234e7d2e17f46cfeed5f6

SHA1 hash:

81d06e1a1dfbc7dd2993ff6fc371bfd6ca00df0f

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

7147369c734d0852c5a9f01ab59e1c82b4bb1a6a32df8981a1ea83d01388bfe6

MD5 hash:

d81fd532e45963f3005e05740692318d

SHA1 hash:

0f20a5b845e8d0abc22a20ed3bd1d51a206f760e

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

3b9e0faed2481cfffc15a092e8a86ea42b94ee75586273494f2d42affa2edb37

MD5 hash:

183059b7b0be8f6cd5a2429b97474a23

SHA1 hash:

f1c748e2baed4d722627b8adf7dc4e1a65f45f37

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

17f4acafa41b6edc5f1a8852de796325eefbfebe950c91cc17a148042704675d

MD5 hash:

a8a87fc0463188d6a3b244cd79d5da6c

SHA1 hash:

370f1bc0f6a7f73e79226a676981c4ce118e0317

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

519762889657a5dbf4e7f2e77f893fad50441c4d217d5734d3ab68448372f6a4

MD5 hash:

1df31e666d0234e7d2e17f46cfeed5f6

SHA1 hash:

81d06e1a1dfbc7dd2993ff6fc371bfd6ca00df0f

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

df0d2460550bf4951ac61b260fb8dac5328b2ba737f48ed454ce9da7f7fa223b

MD5 hash:

b075814eed9a2bccae06cd2d9f9a937a

SHA1 hash:

2c33c6b8232d0d80305489c04c519d8e925b9b5b

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Parent samples :

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

b16d8608c5cb7ba80e03c88e50ee2d5c54ec484ef5b58086a7d67314a96d5ba0

MD5 hash:

1c4b2ffec960d4ce94493d1d9838e68a

SHA1 hash:

8fcd0040f89e5bbe18a690520ec642e2ea120385

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

17f4acafa41b6edc5f1a8852de796325eefbfebe950c91cc17a148042704675d

MD5 hash:

a8a87fc0463188d6a3b244cd79d5da6c

SHA1 hash:

370f1bc0f6a7f73e79226a676981c4ce118e0317

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

df0d2460550bf4951ac61b260fb8dac5328b2ba737f48ed454ce9da7f7fa223b

MD5 hash:

b075814eed9a2bccae06cd2d9f9a937a

SHA1 hash:

2c33c6b8232d0d80305489c04c519d8e925b9b5b

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Parent samples :

SH256 hash:

37489bcc25f8e5c1c5cef29bda5deed746f9311ed0237f91e7004a401591edb4

MD5 hash:

e359b633026653ad8db27f633bddaca6

SHA1 hash:

7303034c185d48693b52f8566921018c2161d1da

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

7147369c734d0852c5a9f01ab59e1c82b4bb1a6a32df8981a1ea83d01388bfe6

MD5 hash:

d81fd532e45963f3005e05740692318d

SHA1 hash:

0f20a5b845e8d0abc22a20ed3bd1d51a206f760e

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

3b9e0faed2481cfffc15a092e8a86ea42b94ee75586273494f2d42affa2edb37

MD5 hash:

183059b7b0be8f6cd5a2429b97474a23

SHA1 hash:

f1c748e2baed4d722627b8adf7dc4e1a65f45f37

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

519762889657a5dbf4e7f2e77f893fad50441c4d217d5734d3ab68448372f6a4

MD5 hash:

1df31e666d0234e7d2e17f46cfeed5f6

SHA1 hash:

81d06e1a1dfbc7dd2993ff6fc371bfd6ca00df0f

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

17f4acafa41b6edc5f1a8852de796325eefbfebe950c91cc17a148042704675d

MD5 hash:

a8a87fc0463188d6a3b244cd79d5da6c

SHA1 hash:

370f1bc0f6a7f73e79226a676981c4ce118e0317

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

SH256 hash:

df0d2460550bf4951ac61b260fb8dac5328b2ba737f48ed454ce9da7f7fa223b

MD5 hash:

b075814eed9a2bccae06cd2d9f9a937a

SHA1 hash:

2c33c6b8232d0d80305489c04c519d8e925b9b5b

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Parent samples :

SH256 hash:

2177882a8fb4bd06c84f61e81cb2fdf862e88f0a86b66a10faa88801696422cd

MD5 hash:

44ba0e88119dec1d2a906ee29e7d20f0

SHA1 hash:

fdefb6aedf90140e433d332cf2663f592da8efaf

Link:

https://www.unpac.me/results/bdc271f8-3930-4425-8e4c-6ccb30ada33d/

Malware family:

AgentTesla.v4

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2177882a8fb4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2177882a8fb4bd06c84f61e81cb2fdf862e88f0a86b66a10faa88801696422cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/402982/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample