MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 6 File information Comments 1

SHA256 hash:	7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7
SHA3-384 hash:	b16d7832b2810b82944beaa5f1853beb21be235dac73c26142f169bd29a6c7cb0938fc686ddd3030d66959ddd56a2e20
SHA1 hash:	ea768268680d272283f9acfd7d7bf1f6bc12bca6
MD5 hash:	96747c013d4d5da97af5acb7bce91c33
humanhash:	fillet-monkey-robin-stream
File name:	96747c013d4d5da97af5acb7bce91c33
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	382'824 bytes
First seen:	2023-07-06 04:20:39 UTC
Last seen:	2023-07-06 04:59:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:PYa6277ozj+CLvTgHOMtyu8MWHSxaBTUMj8gPkWUqM3t/QgzjWE1V+KM:PYI77oz6CLmOM0rQgPy3Ll7+x
Threatray	4'719 similar samples on MalwareBazaar
TLSH	T1B7842390A999C0FBED53A7391D7BC3852DF1F8121A32325B67A06A897933384CE5D743
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

296

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

96747c013d4d5da97af5acb7bce91c33

Verdict:

Malicious activity

Analysis date:

2023-07-06 04:24:05 UTC

Tags:

rat agenttesla

Link:

https://app.any.run/tasks/34660ae2-1546-4e9c-8c65-c2cd76923db4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/408717/

Detection(s):

SecuriteInfo.com.Variant.Jaik.154063.1077.18568.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Restart of the analyzed sample

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Сreating synchronization primitives

DNS request

Reading critical registry keys

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/95697/overview

Behaviour

MalwareBazaar

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/64a6412e8583eaadb34f02cc/reports/a31ec50d-242c-45df-bee5-768f5514d8c4/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/58e16135-7b99-4761-b6b9-8035c13fcf7c

Result

Threat name:

AgentTesla, NSISDropper

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1267732

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected NSISDropper

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-05 13:30:58 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=prqrewgeqf6sxnzqpioyg63i4hziax3f5uprsghxlf4g5reat23q._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

1445df50c20bc522a9a3a27e89e5b14004b1cb208cc72073e3f8d7ada1e7f415

AgentTesla

1d49c75958af33b4be6f0ac91a7d3731d4bffb61ed041851b5de0dcb977f4100

AgentTesla

4cebd982bef6ec25021fecaed19441c39b1756dfd841d1527f38ef6a08974848

AgentTesla

53518c15689d17bacb22589f8587b23f44f5e45514ea7a17c1634a9cdc853466

AgentTesla

59f7e9e010a7055a134a480fb42f32bc7f972c3d85c740d5cd448ea5d463e908

AgentTesla

c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80

AgentTesla

cecd0cf9c4fc70ac66d79284d5a4b44da73ba58f23de44a2a00d028ce46facc9

AgentTesla

f31e33bf7116b2a0b7d78bbeb0f626f564d6febd19296d7628bd76696ce1e617

AgentTesla

+ 4'709 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230706-eym89sac9x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

b7e6efee8f1c7a8ac1b42a436b03534e03d9ab4693e8aeecfc606126ade42137

MD5 hash:

e0bc4b64ecd0c9c3df778bbe8f5ee0f4

SHA1 hash:

fd8a4f7dab49ccc3616a08d80c0cb8a8dd26ce1a

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

SH256 hash:

be6d0b6987f4b937d8230db0f532762611ce4aa5e4c8d49739c971dda5f12e0e

MD5 hash:

b390e6e779d572684ab33bcacbd9346e

SHA1 hash:

c6a0f6335fa293792c4c4dec795b7f1cb3259f95

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

SH256 hash:

b6a075704580bb8867416d19d04be2ce85153440e1d4dcac55e9180fae4d32d2

MD5 hash:

64f836ea7f6eab785d5c192d2e954c7d

SHA1 hash:

72fbf87ec7282d1fd57ee7ddb5860fabd0bfa70e

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

Parent samples :

1d49c75958af33b4be6f0ac91a7d3731d4bffb61ed041851b5de0dcb977f4100
6f38fc7509204ef8b9714ab09f16697665bac64f6b1a3f239660fc6acc0eba3c
cecd0cf9c4fc70ac66d79284d5a4b44da73ba58f23de44a2a00d028ce46facc9
1445df50c20bc522a9a3a27e89e5b14004b1cb208cc72073e3f8d7ada1e7f415
c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80
7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7

SH256 hash:

b7e6efee8f1c7a8ac1b42a436b03534e03d9ab4693e8aeecfc606126ade42137

MD5 hash:

e0bc4b64ecd0c9c3df778bbe8f5ee0f4

SHA1 hash:

fd8a4f7dab49ccc3616a08d80c0cb8a8dd26ce1a

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

SH256 hash:

be6d0b6987f4b937d8230db0f532762611ce4aa5e4c8d49739c971dda5f12e0e

MD5 hash:

b390e6e779d572684ab33bcacbd9346e

SHA1 hash:

c6a0f6335fa293792c4c4dec795b7f1cb3259f95

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

SH256 hash:

b6a075704580bb8867416d19d04be2ce85153440e1d4dcac55e9180fae4d32d2

MD5 hash:

64f836ea7f6eab785d5c192d2e954c7d

SHA1 hash:

72fbf87ec7282d1fd57ee7ddb5860fabd0bfa70e

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

Parent samples :

SH256 hash:

b7e6efee8f1c7a8ac1b42a436b03534e03d9ab4693e8aeecfc606126ade42137

MD5 hash:

e0bc4b64ecd0c9c3df778bbe8f5ee0f4

SHA1 hash:

fd8a4f7dab49ccc3616a08d80c0cb8a8dd26ce1a

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

SH256 hash:

be6d0b6987f4b937d8230db0f532762611ce4aa5e4c8d49739c971dda5f12e0e

MD5 hash:

b390e6e779d572684ab33bcacbd9346e

SHA1 hash:

c6a0f6335fa293792c4c4dec795b7f1cb3259f95

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

SH256 hash:

b6a075704580bb8867416d19d04be2ce85153440e1d4dcac55e9180fae4d32d2

MD5 hash:

64f836ea7f6eab785d5c192d2e954c7d

SHA1 hash:

72fbf87ec7282d1fd57ee7ddb5860fabd0bfa70e

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

Parent samples :

SH256 hash:

7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7

MD5 hash:

96747c013d4d5da97af5acb7bce91c33

SHA1 hash:

ea768268680d272283f9acfd7d7bf1f6bc12bca6

Link:

https://www.unpac.me/results/3976651f-2f10-40c3-95fa-8c4fd5b7dd25/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7c611258c481/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe 7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2677332/

Cape

https://www.capesandbox.com/analysis/408717/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-07-06 04:20:40 UTC

url : hxxp://23.95.122.102/39/ibm_Centos.exe