MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
SHA3-384 hash: b90dba248a3a644ce6d68ac7ce2811ee3f45c8531a434e18232d388807112c6aa22d875c0128d396196e05e738bd272d
SHA1 hash: 03a420e47d6f58d0e3d6d6c76af3420dc81313f1
MD5 hash: 4533b49ce0a3180c1779db32a63aaeba
humanhash: fifteen-edward-summer-hotel
File name:SecuriteInfo.com.Win32.PWSX-gen.32375.31243
Download: download sample
Signature AgentTesla
Create hunting rule
File size:864'256 bytes
First seen:2023-06-27 15:56:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Vv37AaypPsLxWPMOXYqttmlaoMudaCpJUerZsJ0T55:lA5pgxWPJXPtmlazWauJUeru
Threatray 239 similar samples on MalwareBazaar
TLSH T13E0582BD29402E97D475E5B2C263088DF67F7032BF138D6B26D652C1862652E37ED80E
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
315
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.32375.31243
Verdict:
Malicious activity
Analysis date:
2023-06-27 15:58:41 UTC
Tags:
agenttesla rat
Link:
https://app.any.run/tasks/cf4711f3-2e40-4d70-a793-7717c9d2277d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/403339/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.32375.31243.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/649b06d24a3ab977be89023a/reports/5a210366-1deb-4c3f-8d4c-078252684252/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5e02d95a-7823-4e2c-bfbd-54595c56dd97
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1262188
Signature
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-06-27 15:57:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
18 of 24 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eutx6ylk6h3tguzjmuihdnuopqqc67htfclkwq34vps2gldwbkpa._file
Verdict:
malicious
Similar samples:
1ed23ba2f4f0f91fe3ef1cbb68126fa47ca460aa8d77da6f0c345cbaea062292
AgentTesla
3c15327363831cc1f832ff3fc3156339c546dc72ace1342502b5826416adcd28
AgentTesla
60a107b83a792df4cafbe67547cf3663ee3e2277572f8778bb78bd226d9188d8
AgentTesla
6682d37922e7d9bcbb13263a2942817c003aaf48b77e70b9f0a8e24d1895ad02
AgentTesla
8384d93906d4eb8eca32036235be4fe3f1f7c5c810207a3e9edbc9c30b0d4d22
AgentTesla
8e42f5b252ac7d0ef6ab0985047472855d8bd76667bf62ca6f13d0a6c2cb6bdf
AgentTesla
949c549fbf47f559d9e0aa2cb247c955a1d9f35d8b7e4bcb675bd8697b081fe2
AgentTesla
a615a2c647bce3b67f43c818a7fd972a653a605efce83b7eb6f38fb374ec8eba
AgentTesla
bda72294edeb129266485f6fb9fc13a882e363200e61b8052aabc0a1f5c9f055
AgentTesla
e8ccbb18209cd3444552c2d393b0203ad2fc85242ad4705c2f6106dac24dffd0
AgentTesla
+ 229 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230627-tdxpjaff4t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
AgentTesla
Unpacked files
SH256 hash:
a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209
MD5 hash:
e7709a907be0cdb6ff7eb99daee97c6c
SHA1 hash:
bb3f6871c40f54070b53947bf6958d410ea8bac1
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
SH256 hash:
44f0e87507d8b15a916f04f69e4d3f81bbff2f823230a413ed210041bffd6695
MD5 hash:
976455e9c50650dad5696248820a1df7
SHA1 hash:
8cbd1e73f272bc075922d7ea9524b02fbfae64a4
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
SH256 hash:
e9457d533e370f3ebf090fa2d9da5de239fd5ae7a9ea653fdbc5a0f2df405c40
MD5 hash:
a77140618dbf6a2f03b3985c5a16efd9
SHA1 hash:
625f982e5835b34f75e999156a3cdc18dd6d3bb0
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
Parent samples :
24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
5fb756286d572b94dac56ac37ef20f096fbb55f058b6c5189f79d88e7a6bbc6b
SH256 hash:
a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209
MD5 hash:
e7709a907be0cdb6ff7eb99daee97c6c
SHA1 hash:
bb3f6871c40f54070b53947bf6958d410ea8bac1
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
SH256 hash:
44f0e87507d8b15a916f04f69e4d3f81bbff2f823230a413ed210041bffd6695
MD5 hash:
976455e9c50650dad5696248820a1df7
SHA1 hash:
8cbd1e73f272bc075922d7ea9524b02fbfae64a4
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
SH256 hash:
e9457d533e370f3ebf090fa2d9da5de239fd5ae7a9ea653fdbc5a0f2df405c40
MD5 hash:
a77140618dbf6a2f03b3985c5a16efd9
SHA1 hash:
625f982e5835b34f75e999156a3cdc18dd6d3bb0
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
Parent samples :
24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
5fb756286d572b94dac56ac37ef20f096fbb55f058b6c5189f79d88e7a6bbc6b
SH256 hash:
a7e471f7bc560488312d57e885bb4cfc423587a0d84abbb3073a820f7cd0e209
MD5 hash:
e7709a907be0cdb6ff7eb99daee97c6c
SHA1 hash:
bb3f6871c40f54070b53947bf6958d410ea8bac1
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
SH256 hash:
44f0e87507d8b15a916f04f69e4d3f81bbff2f823230a413ed210041bffd6695
MD5 hash:
976455e9c50650dad5696248820a1df7
SHA1 hash:
8cbd1e73f272bc075922d7ea9524b02fbfae64a4
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
SH256 hash:
e9457d533e370f3ebf090fa2d9da5de239fd5ae7a9ea653fdbc5a0f2df405c40
MD5 hash:
a77140618dbf6a2f03b3985c5a16efd9
SHA1 hash:
625f982e5835b34f75e999156a3cdc18dd6d3bb0
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
Parent samples :
24c73577bbb03f99481ddb147930b9289482627c423c816438cfa1eaca58347e
25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
5fb756286d572b94dac56ac37ef20f096fbb55f058b6c5189f79d88e7a6bbc6b
SH256 hash:
25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e
MD5 hash:
4533b49ce0a3180c1779db32a63aaeba
SHA1 hash:
03a420e47d6f58d0e3d6d6c76af3420dc81313f1
Link:
https://www.unpac.me/results/5f0f91d9-41ae-480b-8afd-31516712dd27/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/403339/

Comments