MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580
SHA3-384 hash: 229038b8700cd8f77355fb91b48e388077513fdbfd87673cce636d34d2a705ff2d65bafbbc673d8055b966b7bd06778d
SHA1 hash: a42327e7ad2a570e7c5518fc7dd0e27c280c8d39
MD5 hash: 897253534dc9456ded04a6cde98cde06
humanhash: bulldog-april-alpha-diet
File name:SecuriteInfo.com.Win32.PWSX-gen.13197.31351
Download: download sample
Signature AgentTesla
Create hunting rule
File size:568'320 bytes
First seen:2023-08-07 03:28:34 UTC
Last seen:2023-08-07 21:38:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:AcnRxaS2pVCySQwjaW7CbKzVGFna3i2YZd3K1:TnTzzySbjRzVGhaoR
Threatray 5'516 similar samples on MalwareBazaar
TLSH T1AAC4120D716CD7A1FFBC43F97878419803F572046822E2AD6E945DEE35A6F2E9E01A43
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 1000107171100000 (8 x AgentTesla, 3 x Formbook, 2 x Loki)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
283
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.13197.31351
Verdict:
Malicious activity
Analysis date:
2023-08-07 03:31:56 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/39b0c429-b2e5-498d-a353-a3c30e0bdc25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/440942/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.13197.31351.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/25590b91-fcc8-4013-97dc-5ace324c912b
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1286834
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-08-07 01:04:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fqbdawiq2hlexaji7biz6znhlkothit47qq545532cd732n66waa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
23f0988a2516bbed0cc362a6d88b743bc07dc03c92c38ba4e2796cddbd28a9db
AgentTesla
2685ea1f640c12172fb5e136a624f56fd904627b6523a75c7f9357c0313ec518
AgentTesla
2bed887fca5ae34bb249eb750e20b7542c9209a169745ad2bd9176618042f8ee
AgentTesla
30a2b97369cb49a104c48274ea39b1af4b3a1eb9f8ece684632ee00bc409daeb
AgentTesla
310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931
AgentTesla
333bc1da1ebac150e52df580ad487c35d31caa25bcdd8e06dd1579cd6dd86019
AgentTesla
74e32d627908ba34556010cb469812beab29672d102d1ef23b6e67de10ed9041
AgentTesla
9e9271e281e82549c613d3aba4a0603536a63c960bf42c16302f6b7668de0d78
AgentTesla
d3b064dd11c1c634020c0c155bf9e33c1f0ad2fd8fc85eb1ffd44e05cfd4c291
AgentTesla
dd9072aa04107fc87a791671e749e9b8833fa7885271e392ee1db9fdd30ff7ef
AgentTesla
+ 5'506 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230807-d1xeaaee51/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla
Unpacked files
SH256 hash:
23f0988a2516bbed0cc362a6d88b743bc07dc03c92c38ba4e2796cddbd28a9db
MD5 hash:
e23eedd13ea327d25bdebb8dcf8c12fc
SHA1 hash:
63c7b872a816e77e147d4ff5d5706bfa96205872
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/7a241080-d85f-4015-9e0d-526678acdd3a/
Parent samples :
5d6eb27a75b5149750cb2891e26f18aa808f2cfe9dd633777028bbcbbce10105
333bc1da1ebac150e52df580ad487c35d31caa25bcdd8e06dd1579cd6dd86019
9e9271e281e82549c613d3aba4a0603536a63c960bf42c16302f6b7668de0d78
310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931
e446bfc6a1d4e343f6840965abf9d010f5c32e06b188d3d076fd2e3e0b0bab79
c6e74929d1f5df0946833f77f1074f8a8518a642067b129dae1ad261ded796f2
bf97757e1e84e0b3c97e2df6f9262873ab853605d2859ca93852dcb6d24513a9
5726f0ac293bb3dd4a0fce6bd6e7f7d9ded4ecbed55733bab4c91be2e58be478
b9d37d2bd06ca6ea4cfc72d49f30ffab897351e19f4cd31464a2a3314ee642ba
067aca62f68ca0996bca1267c8fec3859a412a514db8878808bfd576359f5ee9
9ade1aaf821812d038b9bab451e0b48fad06c688e738a522e2d3d9947421209a
4581026ca8972214b08a22a0b621d607997da7586b828e02bfab11a5ca5de33f
4ea83aefa492b4ba2b49e13e34023674ed8b50373a9f521dc887178f60b60965
ea334a8065334c73ce7ab24aaf3aa8d2bf400bfcc1389b5859e76348191a43f5
27e36aeb932b11f7f1a9eb8f7cc2ff7cc7d05549d3936aaaf5a6566cfd72166f
256ea055c6552920ec84ce91c5e9caae6bf9ed5a262c1f237adf8be1a99e8272
40247a3716900e213541061e25967670cfaa9415f554228dd6766e93a0def8f5
9ff3cd3ff6bb45bd888b2eaeebef3aef2784182df2ef03449d435098166882ba
d3b064dd11c1c634020c0c155bf9e33c1f0ad2fd8fc85eb1ffd44e05cfd4c291
2bed887fca5ae34bb249eb750e20b7542c9209a169745ad2bd9176618042f8ee
30a2b97369cb49a104c48274ea39b1af4b3a1eb9f8ece684632ee00bc409daeb
6e41de3cfe2a499488f1eae60dc1ba0f35f0e86c2428271e78bc8ddb51e26d0c
af87ecc512fe3271689f7674ab31070633ac5a85b3a5b2ac585068f3127b77c7
427883d7c6eb502e12e7ae65c1d2c241c8815998faea9dcfd9681d8f40f1f665
f37444849fb5d3f512aa399c0ccc8bbac2dac9a725c7965f445cc472f64a727e
23f0988a2516bbed0cc362a6d88b743bc07dc03c92c38ba4e2796cddbd28a9db
4644d82860cef54c8cd84971e923baa8ddc0347375701c7dbf5a884bb1c5771c
5d0e819a624b53524558b2e89007e0a645123a0e401a4dd5c2e5f709730e8f0e
e1836520ed6edb7fe91462076fdba7e96174e4506e7fd2df69de260199e5c020
2685ea1f640c12172fb5e136a624f56fd904627b6523a75c7f9357c0313ec518
a8ee0501ce8a092cc0cdbbfd3572db5c3ad505e054ffc24e4af4b6678726f850
dd9072aa04107fc87a791671e749e9b8833fa7885271e392ee1db9fdd30ff7ef
5f38f51f0ecaf46523adab8c5597af29894278716ebee0e1a87bde9863424b88
0caa683c9f3f6bcad952386397eb6a3e70d5c0f4b2b3d8b144f03a620e81ef0f
4f20ef240b6cd77d44c9515a39f1f9a4f12cdd84a043fa63a9928fd8728e3106
c0fcad9ddeff65354abef66d0d0ff63091aa7a090e7b281514956367d9bcde40
fa77fd0bc332cc52417da2001bbfee518d2d6cb6c363d15e67d1417afe784325
1f3c7beff0c3f2e7f7c21ae2ad886224c71a739c7554ba8f38aa3f9019ec48db
9e7eaf53bfef161396377f312d623d10c49746779710206acbe408496e50d68e
01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3
2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580
b723d813af59659cb9a6164a6b1e9e2ec42353ca05272cd3b773282e76fc2385
4f9ab5722f95d20fc30c81bf817157c48c6e3f6e53a5a2881ff846be338eb360
f6ceb475c843b5339bdd85afc176eba77bf0d7a133afa4e092e3cd9e93889a7a
4ffdc291532f5d4d2960372a807b3215c9486d6fb643d09c64fc2ecf23cb31d8
eca31a8b84856348ea97f1a1469c8b34f6afc80b79e5a0d40fca44f2a4139d0f
becf6b9764ef6665d04082b9f4879b9bb1fef8976d752411778b7d83fae74057
9de62e10117526b21be8cded286a1522be0237d4b6e24d51d5bef8cd66cf7eb4
47dfb65b3426e320eb7e9ba01ab8fe1e12bc00ffc217f148676638823978c350
4bd728557c59a4ab89a5d3bd881603e69fa41247bab33f22d95404e532b21b24
fcd1fb8ea7cf43f01388e7763017ff869ccd345ce8d4cebfd9b97dbd2496520f
ed3e5af47aca29408248c203ccc55369d5c8e1c7d468b613fd3993fdec39eb08
4b521275a1d1b0a5c527419333dddda642148dde8cefd4fb9a8e4657848844b3
d8c86642c4e7e86d3591143c9bd7a7ca0278ed8812908b81e5633948ebee2eee
ee87b91b6480592bf45354a624ef6b478ed812f5ef33e36dbb6775fe057dbcfa
b68d03062282d38f52d9c19540ec2e1ec85eb501fac42d5ac64c4f77b1e087c1
d7c1ff8739d0d26e441b0828edd8e77700a97d19231d1cf0dbb105735f793ef0
ac3f1194d74f5cc87908936d768285d75e7df2171b653271a59568399b0753de
2af7b3022340dcc9a68e42e7b6c429e12923b62f81a36bb59e61a6121fdf2052
1cbbef03f82222e64ba32d7834fc6d1718b5cdb7f2f9b90ccf7d0732a95615f6
e9f611aaae38af4a81b3dda7c5997a4c8e852b6b87f4462b70bf5b5fa016e584
c7d5597ac8ed4d56434f101e6fe02c9ef5482f36502fa5b4f764b52ea643a5da
c70c391c3da0b64bb0f82437b3ebe6b18efa3cf871c2d890820725a060474bf1
abd4a743c4aa8fb625f1af14edc51606fc1b8e1a15396d9db706c1fd3cf41395
73d86b4c5e0ec35d75e6d81fa0244f5320a267b34fa37b12f5d548958c9390f4
b95ca7569939cdab51f2d7f4b20e8d76cb94a08b26e38aaedf4d6d84faf7d12b
SH256 hash:
685c9d7e1b600153e470b3addb11ae0f0a4eb32818c724385f4674bad5ae8453
MD5 hash:
12dadeb5efa2ad0d1f487b1b038e8c4a
SHA1 hash:
537a1a0a5bf300b1117f490f250423ce4e3e740b
Link:
https://www.unpac.me/results/7a241080-d85f-4015-9e0d-526678acdd3a/
SH256 hash:
1e3652534c160c7b3bcfd1b9ed9c06d924d0de055e2ee34b166bce7cbe4bf67c
MD5 hash:
cd6de66cf179b1ff6a1a3fdc77a4613d
SHA1 hash:
4c96ab670392bfab047536eeeae51d3ed2f4331e
Link:
https://www.unpac.me/results/7a241080-d85f-4015-9e0d-526678acdd3a/
SH256 hash:
acb4f2181a20567f3a024b4919e95a204633c49dd5fa694e73b2c508b2517f62
MD5 hash:
54382de0119d4daa02ec3edd0312168d
SHA1 hash:
0451e80a80e731f260afd2e7c60d9d79069b0a3b
Link:
https://www.unpac.me/results/7a241080-d85f-4015-9e0d-526678acdd3a/
SH256 hash:
2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580
MD5 hash:
897253534dc9456ded04a6cde98cde06
SHA1 hash:
a42327e7ad2a570e7c5518fc7dd0e27c280c8d39
Link:
https://www.unpac.me/results/7a241080-d85f-4015-9e0d-526678acdd3a/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2c02305910d1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/2c02305910d1d64b8128f8519f65a75a9d33a27cfc21de77bbd087fde9bef580

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/440942/

Comments