MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a517cc470024b2760e07a9eade9ece2df25c7ce06c9a08461bca975eee4f342. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a517cc470024b2760e07a9eade9ece2df25c7ce06c9a08461bca975eee4f342
SHA3-384 hash: 59f071733b8c37c737f44742dea56eb631457c207dd01dfe84b7c3e190ddf6bb0365c0f920bf4b01ffb20520dabf8b3a
SHA1 hash: 0542ce46ed6157d806604742e9ce86e3e8d14569
MD5 hash: 19340730eb02c39c8bbca2e524f02138
humanhash: mississippi-cup-blue-robert
File name:ranky.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:217'088 bytes
First seen:2021-05-13 11:48:33 UTC
Last seen:2021-05-13 12:53:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 6144:PQCfWgSv4Fbw78cgih53Z6GAg13aS0K/coZ:PJWgSv4FbC8Mh5pcgEtMc+
Threatray 4'925 similar samples on MalwareBazaar
TLSH 0324F106D7DC66F7E06686BD9CD273606B32FC124923DD5A9D84306D16393872A32F2E
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ranky.exe
Verdict:
No threats detected
Analysis date:
2021-05-13 11:51:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1dec35c2-6b1d-4c42-bd2e-7ca991a5695c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/156114/
Detection(s):
SecuriteInfo.com.Variant.Bulz.282396.7732.30671.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/781013
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7a517cc470024b2760e07a9eade9ece2df25c7ce06c9a08461bca975eee4f342/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-05-13 11:49:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pjixzrdqajfsoyhapkpk32pm4lpslr6oa3e2bbdbxsuxl3xe6nba._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
62e4849bf2b02dd9508f6db60bc9f0d0e982ddfb607b9816e4a777c8cf5542ec
AgentTesla
8e8b3b7c12c9e7113b882eb559fe9fd5cac868f8e3238942bcc9fa893521c5a4
AgentTesla
90089cb8df29d4d8169975ce0545f298aa830376a12a097722ec7f8ef9317760
AgentTesla
a51bd84d3facb55aaa7d351f79a6383f50b362c48a7abf373675aedd13aa9770
AgentTesla
aa128e8000ef9197eed67a5b6f27454e0c1b1878ed7546394fde472d42836eb9
AgentTesla
b3efff040730dd6af8c66d93e0c2bb96273051264abb10182c1c5831b5d7ffcc
AgentTesla
c9af30b2a800c774844eee76e019d10b72c4637adbccd34a6de3bcc8a4f32ba4
AgentTesla
d5fa02045d60d623dacb74b1a719e571982f6a68ea7781c06f8d0ce104b98bd6
AgentTesla
e41c50d817a963a03c07188bda3e42f164f1ce189f2875dc7f5125594d4ec159
AgentTesla
f5a8b50ac13f3ecea0bf447a41128d06f1409689fe95d611574e51ea435c75ca
AgentTesla
+ 4'915 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210513-vqanhaz4wn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/156114/

Comments