MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
SHA3-384 hash: 20179276e32c6f72ebd7e4ad07ad1b9d2aca14f5ac7cf712e6d3bfa3afde3c4a0cdf1be9958de0e61b158233afb01a87
SHA1 hash: 210c4b6a15a7d851c8af06e8284f23fcfc4d15cb
MD5 hash: ee0294a5a3aa7e9dd2b51f1a02b69a49
humanhash: sodium-robert-floor-hot
File name:7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
Download: download sample
Signature AgentTesla
Create hunting rule
File size:815'057 bytes
First seen:2024-10-09 12:25:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 890e522b31701e079a367b89393329e6 (25 x Formbook, 12 x AgentTesla, 8 x Loda)
ssdeep 12288:v6Wq4aaE6KwyF5L0Y2D1PqLJAMC8VLO8HSB/139W5tsRXszKW1M7d4/Qhe:tthEVaPqLJj/OsSBtMuszze7EQ8
Threatray 1'121 similar samples on MalwareBazaar
TLSH T1C90523BE33457177D9D80331FDC743A1C6E0112A5B329D3BF220AC1B6C9D2619E9BA69
TrID 86.7% (.EXE) AutoIt3 compiled script executable (510622/80/67)
4.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
1.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
File icon (PE):PE icon
dhash icon b150b26869b2d471 (468 x Formbook, 101 x RedLineStealer, 94 x AgentTesla)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
390
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367.exe
Verdict:
Malicious activity
Analysis date:
2024-10-09 12:29:07 UTC
Tags:
evasion agenttesla stealer ftp exfiltration
Link:
https://app.any.run/tasks/cfda5161-ed0a-4f3b-9512-8a8de345cb9e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.PSW.Banker6.BTQY.1690.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67067629f936b5621b0bd1f7
Tags:
Agenttesla Autoit
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit lolbin microsoft_visual_cc overlay packed packed packed shell32 upx
Link:
https://www.filescan.io/uploads/6706766342debd6f0518bad2/reports/67cc7fa0-dacd-44c1-b207-33da9c62c1f4/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1a7ad3e8-2745-4a02-bfac-fb8c9d8ae209
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1529922
Signature
AI detected suspicious sample
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367/
Threat name:
Win32.Trojan.Autoitinject
Create hunting rule
Status:
Malicious
First seen:
2024-09-26 13:10:00 UTC
File Type:
PE (Exe)
Extracted files:
54
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pqi4zqlqdaamk62dk5t3yj57szvyrrtobxyn2iqnt47gxxtdintq._file
Verdict:
malicious
Label(s):
admintool_powerrun
Create hunting rule
Similar samples:
00973673a54cfd2a206c7695fa86077d1a1803629d7207b1e5fb295255a25ae2
AgentTesla
8a4f3f97105ed3e4700a34f71fa7f6a8cd6be9479cfba9f79cdd08cb112f62ef
AgentTesla
8d83a9a3bbd6e63e37b6d66c4febdbcf17a48fe77fabdd52c5bfa01a661a33da
AgentTesla
b3647d36c291bd8ab5907166f15e003ee34e07221fde3665611a142a13dca393
AgentTesla
ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5
AgentTesla
e5aebbb2c6ad445d5a2ee5c33a77d8ecfe74cf206433b723736e2e88b9b5d78f
AgentTesla
+ 1'111 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/241009-pl7ggsvamq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Looks up external IP address via web service
AgentTesla
Verdict:
Suspicious
Tags:
trojan
YARA:
MAL_Malware_Imphash_Mar23_1
Link:
https://app.threat.zone/submission/5d6b237f-aa76-4613-a32d-63435e171da8
Unpacked files
SH256 hash:
213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe
MD5 hash:
6001b9d313616cf68a9d9d6bc7492015
SHA1 hash:
6aec558ebca79b3a6a0b4aaf3c9daa18a1fe7cf5
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/7d6655fd-ef3c-4773-8d84-e17c7db52345/
Parent samples :
c9be1ff9d80d934774556669459ad3242500a745531ba25f7c874f32f318cdd1
f08afadff8298941a488a237df4deb8f94f13bf274411548f386d2828f4df636
51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea
bc3e963b1e6f8e375e6814f653eeb463d2bf8e47b867cf16ca9964a5e0d43804
ce89a0a88051c50bf0be5ab41e5f2d478b5f3eac141b37a9743cab99423656ce
c8634453c065450c28be1e99497aea78c294693e0c05e63a6d6fb83cc621f190
71f5ee1f2818fe32525676a403776d620101dfe96ae3873a3e325016ff136002
48d245036c30302a860c3a616e29cb0e633fca178bb363d01007432d3c571713
64786f8c089130fa81ba1970f8bcdee574964bb7653f5aca740a38fc6eef74e2
aa64d8ae63a060c83638ad8a45e5a4e445a53845f4f22fe808f1828663629731
7f8bb8901ac2cd42c191b43dc859d256628e6419a418feed9bf44210b1e4c207
213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe
e46caf67893b64806cdcea05d9b42e52fa65f239cc12782ab31766beac12eb37
2fdefe874a54576e8a4f4566b328120a7163a47b1000af443683af41698b6b2a
717b2beba07031c0671b2cb794d01b5f365c58ab156c0929a05d1cc0f3f4b17e
274013bc54c33bfd77473b8a92016b247b6832a1d26a9f412596cc9189775efe
2ddbd1c388f18a820122163f5c250dbfac936824267487cf0c81fb3b01185b4a
cdd388be236deee1d6613f35f895fa3adc65cd680e560faf0a174b0004c93995
967e07ed35fc477b00fe777c8bd4f5e7ead02d2581987bb75f6386a485799078
2b8f5dfdd98be0d5612f31c49ec4e3abdc14ab16091582f904949a1bdf476ab4
b96a282048c3221ce0180359da5cf97c55c7cfb054f7cfdde1bf5438fdb55399
d8190f8804e6bb5885f42a27307794ceae1fd1d4675b3c6a96d70c30324374bb
44cf26d4eda3a4366204a89842a433c77e44184db6bf2c00a3547288a73d4792
213255cb36f1a19a7d374ba37f98b553f2a10fa9f486e92ed2ca377d1a6dc6d7
4b76f920a96119a383e7c5df2992e9e7fe5e11ef45e1a630dbe8b3abc49abae7
3661575ad4a227bc52a9fcdb9a56ea19e0f882105300b938e9c0b634fe46d892
ebf39fb8c6da07c6f344537cb98113d3f6f34bac9097e2c195bb9073c790d1c5
14825e0e8ecc953c8ddf82dc0af6159ec59d97ea51472a3a025f0a7c2afef1ad
e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854
4eae876a9c21fadb647a6fe14c83272189ace267ebed4b320c73da14e095dec7
34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208
ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5
86c0e8c71fe53ff1ee1ac2a494c208392b9f4128f85552e69105e8fa19724f63
50eae2b11320442a2ac89762a8bac816626850ac2563312a9b421d692fdd8ac2
0eee8e3b1a6558f648e2519e494ea36b8e079bf6e0cbba55bfa9dcbfc99eac11
fc7c241bd2d7edf961b8f1af19fc80419d239c67d72a8eb0610152f1e67841d1
7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
93a9b3b4455c1e8469d1e70599f1ba12d103dbf09d9bcaf079a00e0ca55aa72c
1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af
f8b68f9f0dc3d844e3ae080463b29bc9bb82a750b3ab01aed7fcab4cef1519a8
67bf2a6e18cc9f982fbafc235f75604ab53da2936365bb29dc008470ebfb7fd1
92c5d005c4454ff4be8093157b6f5d5cb11e7254fb3f979ffdddf167e464955f
78d2fb60645775efc2137c4f4dab8f737724f9936577f84fe3e3e01622e9770b
523c3e9f716ca9f2a75109f674135b55e9b25259d5d078175fb5580965426f8a
d2b275edfe93caf7e90362a513f00ffec34f1b10df49d950db008a3417045311
SH256 hash:
f86218e3218eaedd761b2fd4c1c7aef1588608e24b3791a945a1502ecbc2e734
MD5 hash:
ff9d0410de478fa4795435c8d2850b01
SHA1 hash:
67c08e1152b5f5434c3dbe712446314723616ff6
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/7d6655fd-ef3c-4773-8d84-e17c7db52345/
SH256 hash:
c7c98a83413723a601f9bbcf9dab413e992468af7dd841816ba3c8b293766068
MD5 hash:
0d7f7fe889ec4f867a52d396a5cee1ad
SHA1 hash:
be8325104d3bc773b3c65b43b21da200b58503eb
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/7d6655fd-ef3c-4773-8d84-e17c7db52345/
Parent samples :
7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
93a9b3b4455c1e8469d1e70599f1ba12d103dbf09d9bcaf079a00e0ca55aa72c
996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35
31ec408d3d8e7214060637b72783a6f67f3b2742c0ba63330793124cd72b3ea4
SH256 hash:
6f240f9431bdd94fd2d96e4e1644de81fdc5b073bf0518e2f58e95f0d1a394bd
MD5 hash:
90c483ebb93a050c7a6d378065193397
SHA1 hash:
4d203808cb378470bfd2eed38dadf07ce88f4ebe
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/7d6655fd-ef3c-4773-8d84-e17c7db52345/
Parent samples :
7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
93a9b3b4455c1e8469d1e70599f1ba12d103dbf09d9bcaf079a00e0ca55aa72c
SH256 hash:
7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
MD5 hash:
ee0294a5a3aa7e9dd2b51f1a02b69a49
SHA1 hash:
210c4b6a15a7d851c8af06e8284f23fcfc4d15cb
Detections:
MAL_Malware_Imphash_Mar23_1
Create hunting rule
Link:
https://www.unpac.me/results/7d6655fd-ef3c-4773-8d84-e17c7db52345/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments