MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c58671352a3f42ab6965edad693a367b4a6ffbb5339366d0f7672ffdef7e166c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c58671352a3f42ab6965edad693a367b4a6ffbb5339366d0f7672ffdef7e166c
SHA3-384 hash: d8bad3bac951cc05a629ce005810edc2a46983466f658a4ef3ea87b77f30a17edd3494df2134e8db16f27872af1f3a50
SHA1 hash: 715ed2039e13d2ca9c3c5b8a466114312dfab5e3
MD5 hash: 8611e9d3e9b267dfc82949b1bed37f2c
humanhash: xray-gee-louisiana-oven
File name:c58671352a3f42ab6965edad693a367b4a6ffbb5339366d0f7672ffdef7e166c
Download: download sample
Signature AgentTesla
Create hunting rule
File size:738'816 bytes
First seen:2020-11-10 10:59:32 UTC
Last seen:2024-07-24 21:17:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 230f024031d7c58ce0df197af9c448f0 (25 x AgentTesla, 17 x Loki, 16 x NanoCore)
ssdeep 12288:K3c+1X/HU2Gf+ZXRZaTn0ZiblY81D7+1cDl3P8dbUX+ZOgtp:K3coXUf+ZXRZO0wlY8p+SFgAiOgtp
Threatray 2'651 similar samples on MalwareBazaar
TLSH 80F4AE33E2804437D2A32A3C8D5BA7649835BD113D28E9463FF71D4C9F39A612A76397
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Undefined-6662925-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c58671352a3f42ab6965edad693a367b4a6ffbb5339366d0f7672ffdef7e166c/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 11:01:19 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ywdhcnjkh5bkw2lf5wwwsorwpnfg765vgojwnuhxm4x73336czwa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0112dd7ed5fb4dfcc3347366dace7a6e29e50048d8e388f5d8246db84a43d004
AgentTesla
2c0e567384a59c0f113b5016aae24db45e1a7e39a0c9feb157eb98864af4a51f
AgentTesla
4620b2e4808527a39d9c4e6f6e1fa10f6a22a3873e15c3056befcb69001967b4
AgentTesla
8ee2c58f8a8fc555dc2be25df0f819e83f2c6c36a7513c18ddafe160ac94bf11
AgentTesla
982d13f5bd9be208f7843bce14635f41f2e625e01dee879326225a037247c643
AgentTesla
9a55c48d0f35b724b84edcf878ab46d8be542560d5cae69c3c3bee1cee2a2bc4
AgentTesla
c95b9b5cf40c96d46c8a6443c458575ccb0cff8e0f750a3e9506c62a155bcfb0
AgentTesla
cdd24be26b9898cde599ec3163d3b4bec147ceae656616d3a21d46fa5ab8a8a8
AgentTesla
e2f8118a89f59084b6f9e9095b449fed8615757e303314b9d109fb7814fc5eb0
AgentTesla
fb9170b75704e2202310a4ea95652f93cfcc6d4c4700055156ebb8e5532c4a9b
AgentTesla
+ 2'641 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/201110-pht89q7bg6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla
Unpacked files
SH256 hash:
c58671352a3f42ab6965edad693a367b4a6ffbb5339366d0f7672ffdef7e166c
MD5 hash:
8611e9d3e9b267dfc82949b1bed37f2c
SHA1 hash:
715ed2039e13d2ca9c3c5b8a466114312dfab5e3
Link:
https://www.unpac.me/results/b0fdf722-09ce-4e32-907f-b44ec2d50070/
SH256 hash:
fe633e8f1b039a9aeafa0195f9b6c55e8498a05518e676ee248fc819ab51d1f1
MD5 hash:
8f2d51eeb85e4f678d18f76634a9bf41
SHA1 hash:
69fafbc76f30f5509257fd54656c45a5b2519c50
Link:
https://www.unpac.me/results/b0fdf722-09ce-4e32-907f-b44ec2d50070/
SH256 hash:
d0891e972e17869013f819f9d653fb0e6cc78c3cf39153ab0751b47c55d89126
MD5 hash:
34daf8645c0f2423dc0a407a9e16e58c
SHA1 hash:
7abe02cb89ff7d2aa2b269d7514574b7432e6fc1
Link:
https://www.unpac.me/results/b0fdf722-09ce-4e32-907f-b44ec2d50070/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments