MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50c66d64351ff1343d3def42d50213308da45ab388b7a9fe55b7404c358b96be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	50c66d64351ff1343d3def42d50213308da45ab388b7a9fe55b7404c358b96be
SHA3-384 hash:	e3749a462dc728072732891af074a4313f987360fda8ab537c03d387907392dde3d1e0a723d07caed43cfbe062bf06fc
SHA1 hash:	84ea6590551c7d65b98580fc1a8ec319b2868c26
MD5 hash:	907dd7f76b89eced43d35096d1819da3
humanhash:	kentucky-happy-oscar-leopard
File name:	SecuriteInfo.com.Win32.PWSX-gen.26174.1285
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	671'744 bytes
First seen:	2023-12-26 10:14:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:h8CrTMZ7tofzRr9d/Nu1kZypIMrUuA6jiIgkqjVnl36ud0zR/6CtQ9PUHIG8Dn:lrTMf+r91y6MjiIgkqjVnlqud+/2P+A
TLSH	T184E422A29DA38B32C05C1CB4A67B9F61F81572F1AC654ED611313C723C71B8F639786A
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	SecuriteInfoCom
Tags:	AgentTesla exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

413

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox AgentTesla

Detection:

AgentTesla

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/469359/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.26174.1285.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Reading critical registry keys

Creating a window

Stealing user critical data

Unauthorized injection to a system process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

bladabindi masquerade packed packed

Link:

https://www.filescan.io/uploads/658aa7a7f4b6e5e1635a67fe/reports/810d6058-a542-4d70-bf30-ff35c62441fd/overview

Hybrid Analysis MSILHeracles.Generic

Verdict:

Malicious

Labled as:

MSILHeracles.Generic

Link:

https://www.hybrid-analysis.com/sample/50c66d64351ff1343d3def42d50213308da45ab388b7a9fe55b7404c358b96be

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Agent Tesla

Malware family:

Agent Tesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bd65fec8-5422-4c64-bcaa-1cb7c11ac458

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1367007

Signature

.NET source code contains potential unpacker

.NET source code contains process injector

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected Costura Assembly Loader

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/50c66d64351ff1343d3def42d50213308da45ab388b7a9fe55b7404c358b96be

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/50c66d64351ff1343d3def42d50213308da45ab388b7a9fe55b7404c358b96be/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-26 05:19:20 UTC

File Type:

PE (.Net Exe)

Extracted files:

1

AV detection:

18 of 23 (78.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kddg2zbvd7ytipj555bnkaqtgcg2iwvtrc32t7svw5aeynmls27a._file

Threatray agenttesla_v4 agenttesla

Verdict:

malicious

Label(s):

agenttesla_v4

Alert

Create hunting rule

agenttesla

Alert

Create hunting rule

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231226-l98snsecd3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Looks up external IP address via web service

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot6570371458:AAG_RQQpUe6dM0JIuWK3cSdz4tPlbJ3-LX0/

UnpacMe INDICATOR_EXE_Packed_Fody

Unpacked files

SH256 hash:

9161d1a484c1e55e162c19502308c97740cd451572af72c050f0f98d363d6458

MD5 hash:

b68174cb8cbbc37c79db391e0ba0d4da

SHA1 hash:

5f52ed2ab730b961215bfd19c3e82064a9ac5f86

Link:

https://www.unpac.me/results/4651cd5b-3387-4702-9f62-4dd6d3a1669b/

SH256 hash:

50c66d64351ff1343d3def42d50213308da45ab388b7a9fe55b7404c358b96be

MD5 hash:

907dd7f76b89eced43d35096d1819da3

SHA1 hash:

84ea6590551c7d65b98580fc1a8ec319b2868c26

Detections:

INDICATOR_EXE_Packed_Fody

Alert

Create hunting rule

Link:

https://www.unpac.me/results/4651cd5b-3387-4702-9f62-4dd6d3a1669b/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/50c66d64351f/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/50c66d64351ff1343d3def42d50213308da45ab388b7a9fe55b7404c358b96be

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/469359/