MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2f5741617cf3f7d6da4c993e5bae8234d61ec9adfe066e06149f5aa654199cfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 8
| SHA256 hash: | 2f5741617cf3f7d6da4c993e5bae8234d61ec9adfe066e06149f5aa654199cfa |
|---|---|
| SHA3-384 hash: | a65d71668ac7797d095a0d1b9c73da78583f9397a5e156ebcdc0e6cab12c64f2382162caaef7558bd7d4209fee7bb526 |
| SHA1 hash: | 6a1c9b2e3db1ba84b1bb500ce383c93ff1779f20 |
| MD5 hash: | c7cd9d4ebec68d90fa64461b4fa88b21 |
| humanhash: | winner-king-eighteen-helium |
| File name: | c7cd9d4ebec68d90fa64461b4fa88b21.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 530'311 bytes |
| First seen: | 2021-09-22 05:44:32 UTC |
| Last seen: | 2021-09-22 07:14:18 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger) |
| ssdeep | 12288:FLMeE19ta6JpaRLJhAFb9Gwd9/HyuKLmoXq+:1MeW9om0ruxGwd9/HdKPJ |
| Threatray | 1'091 similar samples on MalwareBazaar |
| TLSH | T1E2B42345A1A3D9FFD8A3C7781875B779B10367289112590703946E3BBB0A883ED472FB |
| File icon (PE): |  |
| dhash icon | 64f4d4d4ecf4d4d4 (82 x SnakeKeylogger, 34 x AgentTesla, 24 x Formbook) |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c7cd9d4ebec68d90fa64461b4fa88b21.exe
Verdict:
Malicious activity
Analysis date:
2021-09-22 05:57:04 UTC
Tags:
evasion trojan snakekeylogger keylogger
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Snake
Malware family:
Snake Keylogger
Verdict:
Malicious
Result
Threat name:
Snake Keylogger
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal WLAN passwords
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.LokiBot
Status:
Malicious
First seen:
2021-09-18 10:57:31 UTC
AV detection:
21 of 45 (46.67%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 1'081 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Looks up external IP address via web service
Loads dropped DLL
Unpacked files
SH256 hash:
4a8080d6ebb136ce6b049f9fe7872e164b0266309f4ee8cb610b950b4df727df
MD5 hash:
35aa711c620fc22debb06e38cf761403
SHA1 hash:
7f49427a7f0ceafce19a6dd485ed6d71a0e986eb
SH256 hash:
281166e83a7d071089affcc72684c836fb48cef2ab4dc55cbe9fdb84bf876fb8
MD5 hash:
1281a56864075719c4ef83a3cc3185f1
SHA1 hash:
38c4c80a6cd2a9efb0d1ab4d16bfa3a04bc9d01e
SH256 hash:
2f5741617cf3f7d6da4c993e5bae8234d61ec9adfe066e06149f5aa654199cfa
MD5 hash:
c7cd9d4ebec68d90fa64461b4fa88b21
SHA1 hash:
6a1c9b2e3db1ba84b1bb500ce383c93ff1779f20
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.