MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 6 File information Comments

SHA256 hash:	c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80
SHA3-384 hash:	8963a1dd59a870864743769dade4be22c692727a0d9fd0bf5ea7975fd17968eb874ba04f66e2bf96ded6847dd2fe939e
SHA1 hash:	c834973be88b0d06a81b245820a65c638f44d691
MD5 hash:	059e77ff3865a06b4245596bc8e6dadb
humanhash:	arizona-uncle-maryland-louisiana
File name:	snr.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	308'390 bytes
First seen:	2023-06-26 08:01:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 431 x GuLoader)
ssdeep	6144:/Ya6JsODMj4fPc5DcFyg7nLywr8m1oHaW8IdWsUPlUVs+Gf:/YrsAMj4fPc5ijDkt63ImyO+O
Threatray	4'779 similar samples on MalwareBazaar
TLSH	T18564134AAAE0C4BAC6B3077279364A55276FEB166075E6BF5310BE18BD74183F60C730
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

274

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

snr.exe

Verdict:

Malicious activity

Analysis date:

2023-06-26 08:13:13 UTC

Tags:

agenttesla rat

Link:

https://app.any.run/tasks/25ff1f26-58d8-4b0a-8a43-9a27da4a4810

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/402819/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.67641549.7588.386.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Reading critical registry keys

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/92729/overview

Behaviour

MalwareBazaar

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

formbook lolbin overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/64994610ee55f1e1b4b5835e/reports/6a2dfa9c-e3d7-4f0e-a3fc-dbd2fe1a3aa1/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a6e07cbf-f49b-4431-8465-097683f7555e

Result

Threat name:

AgentTesla, NSISDropper

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1261318

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected NSISDropper

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2023-06-19 23:43:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y5mbzupd33xis5wn2guqxgtwyeyhc337jsgjpa4ngqkpshx3jsaa._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

1445df50c20bc522a9a3a27e89e5b14004b1cb208cc72073e3f8d7ada1e7f415

AgentTesla

1d49c75958af33b4be6f0ac91a7d3731d4bffb61ed041851b5de0dcb977f4100

AgentTesla

4cebd982bef6ec25021fecaed19441c39b1756dfd841d1527f38ef6a08974848

AgentTesla

53518c15689d17bacb22589f8587b23f44f5e45514ea7a17c1634a9cdc853466

AgentTesla

59f7e9e010a7055a134a480fb42f32bc7f972c3d85c740d5cd448ea5d463e908

AgentTesla

6f38fc7509204ef8b9714ab09f16697665bac64f6b1a3f239660fc6acc0eba3c

AgentTesla

cecd0cf9c4fc70ac66d79284d5a4b44da73ba58f23de44a2a00d028ce46facc9

AgentTesla

f31e33bf7116b2a0b7d78bbeb0f626f564d6febd19296d7628bd76696ce1e617

AgentTesla

+ 4'769 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230626-jw54hsha46/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

b1fe697b65c73b235b80ed3db78fe4c188c058755d958b7c1358f95b5e99e382

MD5 hash:

1fb324e48009c9b74323aa11a1c25825

SHA1 hash:

f8d222ecc8b488cd27236e6ef3a4b2551a5320cb

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

SH256 hash:

b6a075704580bb8867416d19d04be2ce85153440e1d4dcac55e9180fae4d32d2

MD5 hash:

64f836ea7f6eab785d5c192d2e954c7d

SHA1 hash:

72fbf87ec7282d1fd57ee7ddb5860fabd0bfa70e

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

Parent samples :

1d49c75958af33b4be6f0ac91a7d3731d4bffb61ed041851b5de0dcb977f4100
6f38fc7509204ef8b9714ab09f16697665bac64f6b1a3f239660fc6acc0eba3c
cecd0cf9c4fc70ac66d79284d5a4b44da73ba58f23de44a2a00d028ce46facc9
1445df50c20bc522a9a3a27e89e5b14004b1cb208cc72073e3f8d7ada1e7f415
c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80
7c611258c4817d2bb7307a1d837b68e1f2805f65ed1f1918f759786ec4809eb7

SH256 hash:

cbdd427191d2558906a7b392672116f71bab47507cfc66850af77075c25d205b

MD5 hash:

8f3b3bd1c3153e466e7e32d9abb9df37

SHA1 hash:

070a53303df721131518b1bc20f253be36e60e03

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

SH256 hash:

b1fe697b65c73b235b80ed3db78fe4c188c058755d958b7c1358f95b5e99e382

MD5 hash:

1fb324e48009c9b74323aa11a1c25825

SHA1 hash:

f8d222ecc8b488cd27236e6ef3a4b2551a5320cb

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

SH256 hash:

b1fe697b65c73b235b80ed3db78fe4c188c058755d958b7c1358f95b5e99e382

MD5 hash:

1fb324e48009c9b74323aa11a1c25825

SHA1 hash:

f8d222ecc8b488cd27236e6ef3a4b2551a5320cb

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

SH256 hash:

b6a075704580bb8867416d19d04be2ce85153440e1d4dcac55e9180fae4d32d2

MD5 hash:

64f836ea7f6eab785d5c192d2e954c7d

SHA1 hash:

72fbf87ec7282d1fd57ee7ddb5860fabd0bfa70e

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

Parent samples :

SH256 hash:

cbdd427191d2558906a7b392672116f71bab47507cfc66850af77075c25d205b

MD5 hash:

8f3b3bd1c3153e466e7e32d9abb9df37

SHA1 hash:

070a53303df721131518b1bc20f253be36e60e03

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

SH256 hash:

b6a075704580bb8867416d19d04be2ce85153440e1d4dcac55e9180fae4d32d2

MD5 hash:

64f836ea7f6eab785d5c192d2e954c7d

SHA1 hash:

72fbf87ec7282d1fd57ee7ddb5860fabd0bfa70e

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

Parent samples :

SH256 hash:

cbdd427191d2558906a7b392672116f71bab47507cfc66850af77075c25d205b

MD5 hash:

8f3b3bd1c3153e466e7e32d9abb9df37

SHA1 hash:

070a53303df721131518b1bc20f253be36e60e03

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

SH256 hash:

c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80

MD5 hash:

059e77ff3865a06b4245596bc8e6dadb

SHA1 hash:

c834973be88b0d06a81b245820a65c638f44d691

Link:

https://www.unpac.me/results/77ce0bb5-1f94-4d12-b5e6-08a7300d14fa/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c7581cd1e3de/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe c7581cd1e3deee8976cdd1a90b9a76c130716f7f4c8c97838d3414f91efb4c80

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/402819/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample