MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 18 File information Comments 1

SHA256 hash:	7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072
SHA3-384 hash:	a60f1cf46ac234306a324e8f95ffe68d936761e196c44b0aea4ae7de9c96aa3b1441ef3bd67d72668162576591b82130
SHA1 hash:	b74847e2c92862fa81db6297d192b26aff898e59
MD5 hash:	642bbf552dc8a71fc044ecee09db0847
humanhash:	pennsylvania-friend-carpet-winter
File name:	642bbf552dc8a71fc044ecee09db0847
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'080'855 bytes
First seen:	2024-02-17 05:13:46 UTC
Last seen:	2024-02-17 07:43:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d3bf8a7746a8d1ee8f6e5960c3f69378 (247 x Formbook, 75 x AgentTesla, 64 x SnakeKeylogger)
ssdeep	24576:fRmJkcoQricOIQxiZY1iaUSY1sbeipkAHj:0JZoQrbTFZY1iaUx0JpvD
Threatray	3'780 similar samples on MalwareBazaar
TLSH	T1D035C021B7D29036C2F326B05D7AF3E65639A9260336C29767D42D377E704822F29772
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	0080828383838303 (1 x AgentTesla)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

448

Origin country :

Vendor Threat Intelligence

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/476572/

Detection(s):

SecuriteInfo.com.Trojan.Inject5.2477.3834.20743.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

autoit fingerprint keylogger lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65d0409be304215defb2d908/reports/b1187770-edc8-4dfa-92e6-131e9b6b5117/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/61f32ce5-36d8-490c-8265-ca8fcf600238

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1393819

Signature

Antivirus detection for URL or domain

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2024-02-13 18:16:33 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=prvbmalkcyo443geqmx33i77wvz6ykaphqlcfeseq56jmrskubza._file

Verdict:

malicious

Label(s):

agenttesla_v4

agenttesla

AgentTesla

37c682dcc881282426e7c3471d95869c867ab1d8278ea8e6ee3f2ec2471ddcdd

AgentTesla

7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072

AgentTesla

c12a4ab95d9caaf2f1a68db084dbfd38ebd65391041925d0417b08e50489f353

AgentTesla

d69af24cb696c4e9de1910acdbced3b8f912e61591c0308a8de7fd798b86ecea

AgentTesla

f2289f7072a9783c0c180de6cf3dd36f5f18f2254941d379b8de9b607e7f1bdd

AgentTesla

+ 3'770 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240217-fwzpysca83/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

AgentTesla

Unpacked files

SH256 hash:

d59d5eaf336cf23e9aeaad8a6b9c8ded508caf2a4ad82fbb19c43e5d2dd1c0ff

MD5 hash:

4164de1f1729cd9cbb3418efcce6d105

SHA1 hash:

b5088bfc4521ca0fdbd36caa8cc139900e8c6fcd

Detections:

AgentTesla

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/76cdb842-f532-4ce5-b406-c53503c81842/

Parent samples :

7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072
e4746dcde06a4199a89bf9cfe3781e6cab2163a89ea8d951b940da10a16e4d7a
4f57445ce960af0f5b9bc7386e6935226955a1221637225bc1d6533d6bd2b88c
07dfcd4aad4d53de15bd688a17d31ce50d591173d60fa2cb629b9ed94179cc2a
6460c253f6d9b12b4598caca091e84040c80a929cae2997f0c9eb11c2897a1f0
1503c743ab140a8432b5e5b11b1af03090df97fb1c4819c38996862dd9f023d2
4bec652194b91669f99a72cdc4dbd2dc25138e6dcd64e62248b5f69aa3539471

SH256 hash:

7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072

MD5 hash:

642bbf552dc8a71fc044ecee09db0847

SHA1 hash:

b74847e2c92862fa81db6297d192b26aff898e59

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/76cdb842-f532-4ce5-b406-c53503c81842/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7c6a16016a16/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AutoIt Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	AutoIT packer

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe 7c6a16016a161dce6cc4832fbda3ffb573ec280f3c16229244877c96464aa072

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/476572/

URLhaus

https://urlhaus.abuse.ch/url/2762912/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-02-17 05:13:47 UTC

url : hxxp://mail.isellemails.com/MediaLight/uploads/a300b665543b8909c.exe