MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa
SHA3-384 hash:	866f9c0c93e75d7e95c0520fc7ab152dea589efeb8f57b74466949a17dd6a9d3edc907d5138234ddfc5fcf5bc3170803
SHA1 hash:	d443d7d09b4e266635a3ce5a7967c7a52ddbcb76
MD5 hash:	29d69339cd32d904e4dcc539bfe80607
humanhash:	foxtrot-uniform-oregon-sad
File name:	AlPDAGITIM FİYAT TEKLİF _PER 001 …scanneed 00101.exe
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	663'040 bytes
First seen:	2024-02-10 11:18:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'612 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:dqUsm6NtjvR1M4YE7mDhOnWrZblbAWYFk6aHpcyNduibTsA9J:dsm4h5FYE7KEnsOkjpcyHnnsA9J
Threatray	1'487 similar samples on MalwareBazaar
TLSH	T14BE4DF89533BAFE2C9A407F0215438920B7DA51A74F8F0BC6D57B4C9C8DAB115BE4B63
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	1313474544444347 (8 x AgentTesla)
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

296

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Win.Dropper.Formbook-10002027-0

Alert

Create hunting rule

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious Packer

Malware family:

Malicious Packer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9907c8f5-22f4-43c4-8626-46d643aa92c3

Joe Sandbox AgentTesla, PureLog Stealer, zgRAT

Result

Threat name:

AgentTesla, PureLog Stealer, zgRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1390139

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Adds a directory exclusion to Windows Defender

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Moves itself to temp directory

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (RTLO)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected Telegram RAT

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-11 08:40:23 UTC

File Type:

PE (.Net Exe)

Extracted files:

11

AV detection:

27 of 38 (71.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=usrev2wqbolkkswnxktvm32rcvq4p2y4veml36uosktdqdqbtgva._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

167ea427613672844817e73ce587a325bbce315affd1636c249249cecbada4b4

AgentTesla

2062e48bd178d835beb3c39a878ea0da87aae5a4a34e3322a12bc3e9e96bf52d

AgentTesla

307f012f74f209e4b8371400455ee296585a6d6a0d4c2195df2186ecaf0acd79

AgentTesla

3298c3e6f25b777c9f772fb1d5123472df0b1046000598d9ed00bd369a56124d

AgentTesla

58dda17dafc74dd89d83c27483ef35cd298a205d543bb7d1e8305d231705277b

AgentTesla

a1fc12e0b11dc727c1e4f58da908d512b2ea1fb69cc317e024390440807d62eb

AgentTesla

bf7d050627a7bf67ad74bed6cf159d30c88423a1c0ef53f9fdc80b6977e79d9e

AgentTesla

c31db24097d178763ff2da3d555e3dba2ad6e2d055c9f22e1a3a0a9f28784162

AgentTesla

f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826

AgentTesla

+ 1'477 additional samples on MalwareBazaar

Hatching Triage zgrat

Result

Malware family:

zgrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:zgrat rat

Link:

https://tria.ge/reports/240210-nevcxabc5z/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Checks computer location settings

Detect ZGRat V1

ZGRat

UnpacMe AgentTesla MALWARE_Win_AgentTeslaV3

Unpacked files

SH256 hash:

8c6b58fd4a86d56336bdb8641020a33bc1a8f77a37837edb0fc4f007088de123

MD5 hash:

3e39b5c3f55298b5881123ee05228baa

SHA1 hash:

e3eac0e6e7c226a3ee0f7e68e957d97ab1f4911e

Link:

https://www.unpac.me/results/4d784e70-431a-4827-be39-802db030d080/

SH256 hash:

10fbf76f5b6f715fc3c136103b5e4b757d184fd2b77d64fc5304c36eaea063d1

MD5 hash:

6894612b52ce435495ea7e5ee9415add

SHA1 hash:

bd772aaee326db17ff27df0359f77c8091c2914a

Detections:

AgentTesla

Alert

Create hunting rule

MALWARE_Win_AgentTeslaV3

Alert

Create hunting rule

Link:

https://www.unpac.me/results/4d784e70-431a-4827-be39-802db030d080/

Parent samples :

025a8321c88613c46fdd67037840f52968d82f623653d56baf67799ebf830611
f2d1383495b3d3b154505fbb97ddb06c01c100d30f7828e71a032db0acbc4a26
08147a0de0bb290829a48536b659527ee1a3c6017df1d1d911f79fd76c0ff859
430b243c159c1263e0dec6b0f332193351d15e723c5d413dadca8c240107f6da
76a2ccfcef756d91adaa6ee5e31af66c87daf0f35062b1e081c25d41aee44f3a
bf670829499b37ad382f284f9dfdcc58df3862f419f070b0c13ec3377f0dfb88
f030a4a82db3734a227b011d76767f6f8b9031ea4666aff7b42d8e0d69d6acea
6f0c010a3563a788cef8ac63c83c7c4f41c5a5834cccf80a907de0216cbc003b
506e064c3d6d2932d75e5209e848eb989c8790eccf85d96001d809234560cbd6
c7f0e4ce6d95ce821671196d361bcd2eb1ac9f6837fd4693968fda7b4f926eac
99f8b58cc35942ee1263c39d53425a6317ca0ded571c82539398e7f1822d20c4
24c69122ace7d707b1838376111192f2bcdbd02531521b656536773b8bc4710c
8048311a5b5bd201679951dc13b0e8d156010f37dda2ceb0396b703fa4ff38c3
5762d98de35eb91afb9d86bad2f0c88e31732dffe13f187667b43a66e33f7e07
3a6d7351d110df11fde83df14b50d25a56ac64ec89dcf19fe093d96557058360
856c8bb75c2b8c79b99f9249c201d20838251a94a4f830afa7995a3af0952842
8b5fdd54d03568aa937bc3e4bebb8972f40860192f38348e0cd97f61f8ab00f7
b9fc651bcd9745a7fe9aafe13a13e3280f22aa10a50a6b54edc908f783f5fdcf
c34595b336cffa1c3c6cf48b44a4a988c213e882a647bef9f887fc6c3a3fd51b
320c4584c3d392006ef443e5743123a45909fbae309c7561ced8fac11e11e5d3
91ae2bc0f6faac51d7cd9c8c8edf0a2d4bfb5e16c3c4e3c221ff4d50925cfd7d
c0d2175379d5613de7a562df8a96a3aa3a9c1b740380aa4a43026a534fc39ef9
34c9273e2941aa8a91c0d15c86799e87a8d3bd39dd16d90c8df3421ac014a10b
f84d789635e636040055b6e95077408820a412d66bb66934112a004ac24d9eba
a5e39f16cb3dec0b3e2b6fe876bbfa1805f2266011289cf24864b3b85d9e5561
b2eb42a73b2d0577b927a7e2f287262116d8b0962e975d66ae7c1f2dc50626a2
744d97984aa09fc2b01b43e56e0c76705031f79a4007e1ea88251b6dde4ccf76
9f6374c06e596c5507f375bd2f58e0cb52ecfeb47a2edaf3171456f5c6cc9552
a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
2974ae3c88a7395eb508e144a3efc57f2dd86be881396bf48b5db5463ada1d51
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
11be7cf9279c9dd3f8584bfafe98ed1aae2d278d3a1e2009203dbac56967cc99

SH256 hash:

c72ca892abebd8794a9544913d071c3c91356f5075509717727e180e87cb98ba

MD5 hash:

25383385b11436b817ed4dc0419f4e24

SHA1 hash:

9441f35f45a30503ebb2c717209f29341b5b48b6

Link:

https://www.unpac.me/results/4d784e70-431a-4827-be39-802db030d080/

SH256 hash:

d8fc5dfdf2800247eb610beb076fec4d2becf6d951e89445d43237fe97814218

MD5 hash:

e5d93dadd08b8bc727e4f4853c6881ba

SHA1 hash:

27e0e057d33f01586193b0cbf06561c2863951f4

Link:

https://www.unpac.me/results/4d784e70-431a-4827-be39-802db030d080/

SH256 hash:

c3c6bb0e54c17ff3dfae5c3f540589ff900435f4a4e56c3be1acd3f5d3bbd4aa

MD5 hash:

878783f5d37028362059cfc0f00eeb47

SHA1 hash:

1ffec5c6e291a10c8bf9ca1f19a2150814bed1f1

Link:

https://www.unpac.me/results/4d784e70-431a-4827-be39-802db030d080/

SH256 hash:

a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa

MD5 hash:

29d69339cd32d904e4dcc539bfe80607

SHA1 hash:

d443d7d09b4e266635a3ce5a7967c7a52ddbcb76

Link:

https://www.unpac.me/results/4d784e70-431a-4827-be39-802db030d080/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a4a24aead00b96a54acdbaa7566f511561c7eb1ca918bdfa8e92a6380e0199aa