MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 5 File information Comments

SHA256 hash:	7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82
SHA3-384 hash:	b1ad8b3c08858cac87227ca49077439eefc003b29aef5adadb86da5c03bcbde905b7ff9cad8997baca66188be4b790f0
SHA1 hash:	4e5e24a91323c730351c826f1e378f6954c67819
MD5 hash:	d36abe994d29b1d47619b158b1336dbd
humanhash:	harry-grey-autumn-montana
File name:	HUFEDDTS2025.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	859'648 bytes
First seen:	2025-02-12 16:09:22 UTC
Last seen:	2025-02-12 16:42:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:IoaovT2lPK7JreP6CMdctG5sCdK1mJ1Xfm/yEmT3EIdGwRokJCcAOO/0vWp4Aazq:Z2BKRtCM2tG5sCk1mPXKiUI
Threatray	4'677 similar samples on MalwareBazaar
TLSH	T104058EDCB610778ECC16C7308974AC7492153CBAB236715F95CB3797BA6F1838E18A92
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	0307612c88000000 (65 x AgentTesla, 47 x RemcosRAT, 9 x MassLogger)
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

AgentTesla SMTP exfil server:
mail.grupomorales.mx:587

Intelligence

File Origin

# of uploads :

# of downloads :

471

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82

Verdict:

Malicious activity

Analysis date:

2025-02-12 01:33:07 UTC

Tags:

stealer exfiltration agenttesla smtp

Link:

https://app.any.run/tasks/c465ba15-0967-4f7d-8d95-9ffc76f868bd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.14637.4862.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67acc7ee4f5583c4c4d86ccd

Tags:

agenttesla lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Adding an exclusion to Microsoft Defender

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated obfuscated obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/67acc7f7c24a487ec9d0bce2/reports/b7ad0123-25b8-4af5-a429-56a7277617f7/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/41da04e2-26d8-4dcd-b2aa-6bb02aa76dc9

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1613315

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2025-02-11 05:51:50 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ps6kttortnmoyfavj6wqphekuvunkcntqxs7dgexww74szd4lsba._file

Verdict:

malicious

Label(s):

agenttesla

unknown_loader_037

AgentTesla

50a0786c77f3dde200940934383e97f756189a70865954f72c25ffa486240e78

AgentTesla

8e410f45c665e8e5d2e5e690b37e232a596d3c975842a61fd9acf6f46161d7ca

AgentTesla

error

AgentTesla

f7cdea5cbabbed3fe3e137d50076ba977d6cc21490b350784bb4628a9914da40

AgentTesla

+ 4'667 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250212-tmg1faypav/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/48e7dfff-4ede-4612-a7dc-8c79ae4c603b

Unpacked files

SH256 hash:

7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82

MD5 hash:

d36abe994d29b1d47619b158b1336dbd

SHA1 hash:

4e5e24a91323c730351c826f1e378f6954c67819

Link:

https://www.unpac.me/results/aeb3d4df-f89d-40b7-bcc2-1b9bd4223cf1/

SH256 hash:

9dff69ae0b8da0b474414fcbe6f31dcf46157a261aa7a6b6d52bc0f25acdb838

MD5 hash:

95fb0876d6d37d149450be7fee9d29e7

SHA1 hash:

37b3fdb34c1008470a2ecb4845982da97eeb657d

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/aeb3d4df-f89d-40b7-bcc2-1b9bd4223cf1/

SH256 hash:

bf63d7998c512ebfaff4745b7536c583257ca145bf1a54dbca6b290c8c30b879

MD5 hash:

06ba662044c2b9eabeecc3b1ce80542e

SHA1 hash:

488b69b6a2adfa0422aea6824d25d3595a97412c

Detections:

AgentTeslaXorStringsNet

MSIL_SUSP_OBFUSC_XorStringsNet

INDICATOR_EXE_Packed_GEN01

Link:

https://www.unpac.me/results/aeb3d4df-f89d-40b7-bcc2-1b9bd4223cf1/

Parent samples :

860c3c28fe9c4d8b7a334ea7df96b0e18d8cec439738c744b891a954160bbe1f
f211a840befa45cad5c369f64b91ff53d0dba7e98835dec3886ded59746e7333
4f6abf63121d8ac6db6af1b4aaa3331822ebf670bb70a98720d759cd41ec6a90
f7cdea5cbabbed3fe3e137d50076ba977d6cc21490b350784bb4628a9914da40
50a0786c77f3dde200940934383e97f756189a70865954f72c25ffa486240e78
8e410f45c665e8e5d2e5e690b37e232a596d3c975842a61fd9acf6f46161d7ca
7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82
804aee8eba800043c912038c55c36edeb8dd761913047e99b4a5e8d8cb8ef6c4
6b6d63171af81a14bc15dc32c65b20ceade64462777a035f9eb04cf3b3f86be9
434a96eda6f4f679eabaf911cbd3e6fae660bbf5db67f7abdcc1aac4b4df44cf
1fd01b430ccbb37347f138336cfecba2b6ac2c1eb2094a016588c448b092f7b3
3fdfd6e43f7328a408c2c5f27faf60cbf213f595c21cfd5b2fdd54170fcd2036

SH256 hash:

04dcc469e40454cf980ec9be6ae4b29916fc17d208e226b176e36fae42cd5a94

MD5 hash:

c27729187fec894310ed8ff77388ed02

SHA1 hash:

ba0931843b61239a92a8ff025eca6f371589d1e6

Link:

https://www.unpac.me/results/aeb3d4df-f89d-40b7-bcc2-1b9bd4223cf1/

Malware family:

AgentTesla.v4

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7cbca9cdd19b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7cbca9cdd19b58ec14154fad079c8aa568d509b385e5f19897b5bfc9647c5c82

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample