MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a6f8590d4be989faccb34cd393e713fd80fa17e92d7613f33061d647d0e6d12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a6f8590d4be989faccb34cd393e713fd80fa17e92d7613f33061d647d0e6d12
SHA3-384 hash: 48703dfc8194bd71532b7225816b23e80193e33d02496518d69010b89f030cc519ee977ace0579c358bc005763a2e322
SHA1 hash: 02f07b3badc63785cd66b181657322f851d3b0c2
MD5 hash: 0ed458621a0e75e9dac09b9cf00b909d
humanhash: july-sweet-beer-equal
File name:SecuriteInfo.com.BackDoor.SpyBotNET.25.6539.4149
Download: download sample
Signature AgentTesla
Create hunting rule
File size:658'944 bytes
First seen:2021-07-27 12:38:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a31761b5a590c4c499d5f4a347d75c12 (23 x Formbook, 17 x AgentTesla, 6 x RedLineStealer)
ssdeep 12288:pn/zDvGHAykHSzLW/4+8bzbBSreMdbhgFK/UqWgmrMqir:NzbGHAzHAjX1CcLgYi
TLSH T199E4AE57F7D7FAB0E6BE827A82B1851C537674920260A78F674072896D23392493DF0F
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.BackDoor.SpyBotNET.25.6539.4149
Verdict:
No threats detected
Analysis date:
2021-07-27 12:44:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4ccbd2c4-4921-421d-9f27-2baa82bb7a88

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/174340/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.6539.4149.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1fca549c-bdbe-48f3-9311-bc69be6fd594
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/822340
Signature
Found malware configuration
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 454752 Sample: SecuriteInfo.com.BackDoor.S... Startdate: 27/07/2021 Architecture: WINDOWS Score: 64 40 Found malware configuration 2->40 42 Yara detected AgentTesla 2->42 44 Yara detected AgentTesla 2->44 7 loaddll64.exe 4 2->7         started        process3 process4 9 iexplore.exe 1 74 7->9         started        11 rundll32.exe 7->11         started        13 cmd.exe 1 7->13         started        15 16 other processes 7->15 process5 17 iexplore.exe 149 9->17         started        20 WerFault.exe 11->20         started        22 rundll32.exe 1 13->22         started        24 WerFault.exe 15->24         started        26 WerFault.exe 15->26         started        28 WerFault.exe 15->28         started        30 WerFault.exe 15->30         started        dnsIp6 32 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49767, 49768 YAHOO-DEBDE United Kingdom 17->32 34 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49764, 49765 FASTLYUS United States 17->34 38 11 other IPs or domains 17->38 36 192.168.2.1 unknown unknown 20->36
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-27 12:39:05 UTC
AV detection:
8 of 28 (28.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pjxylegux2mj7lglgtgtsptrh7ma7il6sllwcpztayowi7ionuja._file
Verdict:
unknown
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210727-1s6sx9y4ae/
Behaviour
Suspicious use of AdjustPrivilegeToken
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
7a6f8590d4be989faccb34cd393e713fd80fa17e92d7613f33061d647d0e6d12
MD5 hash:
0ed458621a0e75e9dac09b9cf00b909d
SHA1 hash:
02f07b3badc63785cd66b181657322f851d3b0c2
Link:
https://www.unpac.me/results/83b2befb-a3af-4d2a-a581-b309244b5123/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a6f8590d4be989faccb34cd393e713fd80fa17e92d7613f33061d647d0e6d12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/174340/

Comments