MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41ecd979cc674d2a1189fde9da4899b13240154e9acb0e54cdd81e08624c2977. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41ecd979cc674d2a1189fde9da4899b13240154e9acb0e54cdd81e08624c2977
SHA3-384 hash: 44c78584308887378ceb60f54d4df14c15d28e8c3d31c5c3038888cb095b89e4008a07f9de3b87177fd98c0c29862b79
SHA1 hash: ae68156366cfaca06a0fce73ec694fbc0aa4dccd
MD5 hash: 39274680f075dd14ef063eb67d8d7255
humanhash: september-early-carpet-kitten
File name:SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640
Download: download sample
Signature AgentTesla
Create hunting rule
File size:7'863'390 bytes
First seen:2024-10-10 11:52:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b1c5b1beabd90d9fdabd1df0779ea832 (11 x CoinMiner, 10 x QuasarRAT, 8 x AsyncRAT)
ssdeep 196608:eqwPbZzrIoA+gjWxug5xzPtIxY8unUAwnlzUP:yzycI4tIi1nUADP
TLSH T12F8623D2D6900AA0DAB6EF3895735C26D3BB3E983E31FC4B1998B0623F732D45525712
TrID 76.9% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
16.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
3.0% (.EXE) Win64 Executable (generic) (10522/11/4)
1.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.5% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon 29c3633766165789 (1 x AgentTesla)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
396
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640
Verdict:
Malicious activity
Analysis date:
2024-10-10 11:54:18 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/e7d224e8-bbf8-47d0-9255-ba8586908e38

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6707c025ab31793a7b214dd3
Tags:
Vmdetect Exploit Zerber Micro
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm dllhost fingerprint fingerprint installer lolbin lolbin microsoft_visual_cc overlay packed packed remote setupapi sfx shdocvw shell32
Link:
https://www.filescan.io/uploads/6707c022138022833756ba4b/reports/6e382ff6-23f1-40f9-82d3-4f929be48baa/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/41ecd979cc674d2a1189fde9da4899b13240154e9acb0e54cdd81e08624c2977
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/05bcf46c-85bc-4bda-855c-567fe738e336
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1530753
Signature
AI detected suspicious sample
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive port information (via WMI, Win32_SerialPort, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/41ecd979cc674d2a1189fde9da4899b13240154e9acb0e54cdd81e08624c2977
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41ecd979cc674d2a1189fde9da4899b13240154e9acb0e54cdd81e08624c2977/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihwns6omm5gsuemj7xu5usezwezeafkotlfq4vgn3apaqysmff3q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/241010-n2al1s1ann/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c0db55b2-fba1-46de-a92d-17c8e247c49c
Unpacked files
SH256 hash:
e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd
MD5 hash:
c97f23b52087cfa97985f784ea83498f
SHA1 hash:
d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 hash:
195ffb7167db3219b217c4fd439eedd6
SHA1 hash:
1e76e6099570ede620b76ed47cf8d03a936d49f8
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9
MD5 hash:
ed5a809dc0024d83cbab4fb9933d598d
SHA1 hash:
0bc5a82327f8641d9287101e4cc7041af20bad57
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
cfc2a838569a48d16a15269bb701de87b81b3d2bc303bb7c4c3724cc3bba0c50
MD5 hash:
0b3b4e8d1de31f844e466d61cf7937b5
SHA1 hash:
d699e5b46a14ea4d7c052e4193f85f0a4f2b29eb
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
MD5 hash:
34ea7f7d66563f724318e322ff08f4db
SHA1 hash:
d0aa8038a92eb43def2fffbbf4114b02636117c5
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
b6de87ff6fdde6d0a245ef37fe81fac49523c35115c61bc002e4935d99875508
MD5 hash:
d496ce3436511c6a4d826ab418cf8b6d
SHA1 hash:
e26b538a3ae8b0a231011d5c9b7fc26291b346ef
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
646f35f2fada20ac9c9d380950d80cbce122367baf7e415818eb1836ac34547d
MD5 hash:
e1e8685c6ae7b57cd1b8c735685d74a0
SHA1 hash:
d2b3eb92a98b861429b2686abbe804ac4b55b2fe
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
405852e9a59d31045b7e585bef2609ae462e5d5ade6cfefa2e4fda9b9c2987f3
MD5 hash:
f8ab944a579990572fb44141fc20d34c
SHA1 hash:
97b35a9d7c53bd1834433d5fbeaa894f0751fc7b
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
2719973d27fcff2ab02765d270817bae2314f22d86abe36b54c27644cabbf12f
MD5 hash:
8e30aa56adcbd4053bdbde80a8960a8a
SHA1 hash:
8e88d37a06873517254330b72e444eff3085ff4f
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65
MD5 hash:
ab4c3529694fc8d2427434825f71b2b8
SHA1 hash:
7be378e382e43eae84f1567b3570bca9a67e7697
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
SH256 hash:
41ecd979cc674d2a1189fde9da4899b13240154e9acb0e54cdd81e08624c2977
MD5 hash:
39274680f075dd14ef063eb67d8d7255
SHA1 hash:
ae68156366cfaca06a0fce73ec694fbc0aa4dccd
Link:
https://www.unpac.me/results/1909ba09-f1a2-4fc0-91dc-356fe16ee9bd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41ecd979cc674d2a1189fde9da4899b13240154e9acb0e54cdd81e08624c2977

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipAlloc
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW

Comments