MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5
SHA3-384 hash: b5f5c606e5b447feedfb2a17c2a5509202d82ad4d2be5aa11756e089bebe82c37238d9f4927fcdeb11c740af3b010d3f
SHA1 hash: 0db726ff4e0f48056d196947555afc7d9c9c8448
MD5 hash: e6b94c6b7f9fc977aa8c5ee478ff4671
humanhash: mexico-chicken-kilo-moon
File name:adwcleaner.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:837'472 bytes
First seen:2025-09-12 17:28:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep 12288:sjZ5861IjJQPVle85OtX8RGt/sxqa2GqrTkNml9IXbYJWY/G5:sn861IjJKOZ8RGtUxqa2uNml9IsJWYG
Threatray 1 similar samples on MalwareBazaar
TLSH T11B05800CBEB0E8C0CD19A9738AE5D4043B315D81AF11B672AD157EE9FB7636215A21FC
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter BastianHein
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
CL CL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
adwcleaner.exe
Verdict:
Malicious activity
Analysis date:
2025-09-12 17:31:14 UTC
Tags:
auto-sch sheet rat anti-evasion auto-reg
Link:
https://app.any.run/tasks/47906cc9-6b98-487f-aac7-50153eb81405

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/27229/
Detection(s):
Win.Packed.Marsilia-10021147-0
Create hunting rule

Win.Packed.Packy-10036375-0
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c45858e579c633a4b4ba8f
Tags:
autorun virus shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Running batch commands
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Connection attempt to an infection source
Creating a file in the Windows directory
Enabling the libraries to load when starting the app (AppInit_DLLs)
Query of malicious DNS domain
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Enabling autorun
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 invalid-signature obfuscated overlay reconnaissance signed vbnet
Link:
https://www.filescan.io/uploads/68c4584b732879482928590f/reports/9ef412db-c790-4aa7-8262-d2588f926eb6/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-10T15:02:00Z UTC
Last seen:
2025-09-10T15:02:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac7903dc-4c96-4a57-b86b-14240a921c09
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.82 Win 32 Exe x86
Link:
https://app.malva.re/file/e6b94c6b7f9fc977aa8c5ee478ff4671
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5/
Verdict:
Malicious
Threat:
Backdoor.MSIL.SheetRat
Link:
https://tip.neiki.dev/file/c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5
Threat name:
ByteCode-MSIL.Trojan.Zilla
Create hunting rule
Status:
Malicious
First seen:
2025-09-12 17:28:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y52kml5fnzetb2aea3tdy3mt5bh4mlmzcv25t5jygirj7qjknksq._file
Verdict:
malicious
Label(s):
sheetrat
Create hunting rule
Similar samples:
c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5
AgentTesla
error
AgentTesla
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution persistence privilege_escalation
Link:
https://tria.ge/reports/250912-v2aqcabq4z/
Behaviour
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Drops file in Windows directory
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Event Triggered Execution: AppInit DLLs
Modifies WinLogon for persistence
Verdict:
Malicious
Tags:
Win.Packed.Marsilia-10021147-0
YARA:
n/a
Link:
https://app.threat.zone/submission/1d5afe7a-3801-4e14-a538-8cb51abbb310
Unpacked files
SH256 hash:
c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5
MD5 hash:
e6b94c6b7f9fc977aa8c5ee478ff4671
SHA1 hash:
0db726ff4e0f48056d196947555afc7d9c9c8448
Link:
https://www.unpac.me/results/e624da9a-92ad-4f42-9818-94b2ca1a4ad5/
SH256 hash:
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 hash:
16e5a492c9c6ae34c59683be9c51fa31
SHA1 hash:
97031b41f5c56f371c28ae0d62a2df7d585adaba
Link:
https://www.unpac.me/results/e624da9a-92ad-4f42-9818-94b2ca1a4ad5/
Malware family:
Alcatraz
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c774a62fa56e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c774a62fa56e4930e80406e63c6d93e84fc62d991575d9f53832229fc12a6aa5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27229/

Comments