MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d5f3816a87af0cb1b95e4db31fd3aacfe6d47d75c9e83b5f378a6d133584248. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7d5f3816a87af0cb1b95e4db31fd3aacfe6d47d75c9e83b5f378a6d133584248
SHA3-384 hash:	83aa7d333bb92dc3bf77f78025e41c6e24214b57ca48c90ad18ecf690bdb82d636cb0d63de803c95164933cf8213a9cd
SHA1 hash:	1845494a0657558962973ad16954ef9f8a2a1fc7
MD5 hash:	1a14b78a36c21651f378445e27bd9c50
humanhash:	uncle-venus-winter-nitrogen
File name:	SecuriteInfo.com.Win32.PWSX-gen.1291.19904
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	992'768 bytes
First seen:	2023-12-20 14:15:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:ki23sWYqHAOs75cZCNflwy/BVwxUPLC4YB5lri/ItKn1Yaq10xYzdtyncqP7r9ry:ki/WjHUNcZmPByfKnme1q
TLSH	T17D258C98F540759DCC1ACB358A75CC30A6227DBA563AD10E10DB3DAB7F7E6D38A101A3
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	d4c4c4d8ccd4f0cc (241 x AgentTesla, 65 x Loki, 41 x Formbook)
Reporter	SecuriteInfoCom
Tags:	AgentTesla exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

314

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox AgentTesla

Detection:

AgentTesla

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/468631/

ClamAV Detected

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Win32.PWSX-gen.1291.19904.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6582f726f4b6e5e16351e76a/reports/7299de37-08cb-4658-b8d2-5019873d680e/overview

Hybrid Analysis Ransom.Loki.Generic

Verdict:

Malicious

Labled as:

Ransom.Loki.Generic

Link:

https://www.hybrid-analysis.com/sample/7d5f3816a87af0cb1b95e4db31fd3aacfe6d47d75c9e83b5f378a6d133584248

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/0600b067-a5c5-4924-bf31-db415629242f

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1365072

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to log keystrokes (.Net Source)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/7d5f3816a87af0cb1b95e4db31fd3aacfe6d47d75c9e83b5f378a6d133584248

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/7d5f3816a87af0cb1b95e4db31fd3aacfe6d47d75c9e83b5f378a6d133584248/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-20 11:39:47 UTC

File Type:

PE (.Net Exe)

Extracted files:

63

AV detection:

24 of 37 (64.86%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pvptqfviplymwg4v4tntd7j2vt7g2r6xlspihnptpctncm2yijea._file

Threatray agenttesla_v4 agenttesla

Verdict:

malicious

Label(s):

agenttesla_v4

Alert

Create hunting rule

agenttesla

Alert

Create hunting rule

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231220-rk4qbaggfr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

UnpacMe AgentTesla win_agent_tesla_g2 INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Agenttesla_type2 INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients INDICATOR_EXE_Packed_GEN01 INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unpacked files

SH256 hash:

797e57bd74a68f7b4808a213f5c319ee4f4b023bc73088175d4393dfee9fe329

MD5 hash:

3c927935fbd608e7628cc2c5ad7d52fd

SHA1 hash:

ee0c880c0614ac960fd641f7d479233584aed1d8

Link:

https://www.unpac.me/results/ab166f9b-cb75-42fc-be03-a358437e759a/

SH256 hash:

c5328f7af843244b56d6a208c322a9315daea139d1b255cda993b243e4394ecf

MD5 hash:

160f4669c06c6496d79a92ea9d33e89b

SHA1 hash:

baae226fdb2a9739f118db781bdc74f2efc6a585

Link:

https://www.unpac.me/results/ab166f9b-cb75-42fc-be03-a358437e759a/

SH256 hash:

23c3be87dc90e66d2cd5907d1d4a3849e6a5c99d8d4d0a6ecf5e28e45473183f

MD5 hash:

e8873f8d4fa1656a14357ee8b6f86d77

SHA1 hash:

5ab97da283c0c15e093fb9795451f8feeb36b985

Link:

https://www.unpac.me/results/ab166f9b-cb75-42fc-be03-a358437e759a/

SH256 hash:

133ecf75de9fdeed268dc746afc7ec1ae2f128e208c41d7b37b51bf76843ffb4

MD5 hash:

103ea4b28710ffe97ec72422b707e71d

SHA1 hash:

438ad17788c6c155b9bacd5649f43c09c4cdb77b

Detections:

AgentTesla

Alert

Create hunting rule

win_agent_tesla_g2

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Alert

Create hunting rule

Agenttesla_type2

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Alert

Create hunting rule

INDICATOR_EXE_Packed_GEN01

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Alert

Create hunting rule

Link:

https://www.unpac.me/results/ab166f9b-cb75-42fc-be03-a358437e759a/

Parent samples :

133ecf75de9fdeed268dc746afc7ec1ae2f128e208c41d7b37b51bf76843ffb4
ff35d25496862b10860706136636b1001bd46f42856bd75fb4f8c32ca2fa05c0
e5ba53de1a80eda27337da32ad9bf522473c542fc42a434fff3fc843cbdf88ed
b091bf4326241b1053f88a1a47618fee3f87ccdce873a9bb79e653670b7e4948
8d693225be9e1f824c20f3bc2f71a9c21e87a2b32bca274580b7abad75ecacbb
7d5f3816a87af0cb1b95e4db31fd3aacfe6d47d75c9e83b5f378a6d133584248
486d2fae164dfd24b2d443ffd775d83f33136a746bded12f3e05cade26bacd24

SH256 hash:

7d5f3816a87af0cb1b95e4db31fd3aacfe6d47d75c9e83b5f378a6d133584248

MD5 hash:

1a14b78a36c21651f378445e27bd9c50

SHA1 hash:

1845494a0657558962973ad16954ef9f8a2a1fc7

Link:

https://www.unpac.me/results/ab166f9b-cb75-42fc-be03-a358437e759a/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7d5f3816a87a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/7d5f3816a87af0cb1b95e4db31fd3aacfe6d47d75c9e83b5f378a6d133584248

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/468631/