MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7c371104c985df2506b6f9b0e4133e61c96e45d9f96a9961369d52e9f9f972b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7c371104c985df2506b6f9b0e4133e61c96e45d9f96a9961369d52e9f9f972b
SHA3-384 hash: a9c35970e09802b953735c5bdaa1210e8b87e1949dab58196795246677eec3f84ccd5ab2c1f9c2362a540bebb7c297db
SHA1 hash: 3f0e93538cfe90cb861dd5a39399856b9e436569
MD5 hash: b461498b2b36f21dca6da5c3dc57cc1a
humanhash: california-golf-angel-eleven
File name:b461498b2b36f21dca6da5c3dc57cc1a
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'039'872 bytes
First seen:2020-11-17 14:49:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:f95VtmxXpS9Wjy7ABaCu5cV3Pi11SkFHMBf/NQxeLo52Yey7th7KI5U6Q3EzeFn:PApyEnu5e01Ska/ifNegtFLU6Q3Ez
Threatray 1'427 similar samples on MalwareBazaar
TLSH 62259E525E846B9AE0745BB799986430A7F4FE02C3E2CD997CA9358ED671F30F843212
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7c371104c985df2506b6f9b0e4133e61c96e45d9f96a9961369d52e9f9f972b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 09:25:05 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y7bxcecmtbo7eudln6nq4qjt4yojnzc5t6lktfqtnhks5h47s4vq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
19006e1934a36332207bb746cdfad53e5264682ed947d4f6c99debecefe12f99
AgentTesla
19a8a4216e0f95f9c4ad7d8318599a9e91791867e3b757b16eae9b2f1e38a143
AgentTesla
2ff93944081c104e8175f5209255c50e92d65f8a3e35fbf01c5f6f46237575af
AgentTesla
38025fc17a575c25042524cf59381b44c8256b673d2a754418e579139b6ba893
AgentTesla
52a8719e0795679e8336c841ddc5f6b0a74b5e423c4b71fe0db3ddbfbc3f7e7a
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
8de3d12f5661c36ae89e13085dc5d4c6db3000e434f960eb80adece4aaae8219
AgentTesla
97c73eb27f164d01020de5531c96adb305bfdd8e6ec727bfaf65a2fa7b02638a
AgentTesla
abf3d62c029da4a935ffde31a6559242200cc0b0483c0b552e714d54170407a6
AgentTesla
d5a2e34a8816a75fe9d6cd9b9035040ea5777429dc7eeebc0ebb7f8a4d897495
AgentTesla
+ 1'417 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-2dnxanmw8n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c7c371104c985df2506b6f9b0e4133e61c96e45d9f96a9961369d52e9f9f972b
MD5 hash:
b461498b2b36f21dca6da5c3dc57cc1a
SHA1 hash:
3f0e93538cfe90cb861dd5a39399856b9e436569
Link:
https://www.unpac.me/results/075ecce1-4986-4d2b-81a5-28953696345a/
SH256 hash:
c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b
MD5 hash:
b5358f677850210361f573c7d249c258
SHA1 hash:
215e06e319515d779efa88f7c05b343d6ec3f6a5
Link:
https://www.unpac.me/results/075ecce1-4986-4d2b-81a5-28953696345a/
SH256 hash:
b7e22548decb1ede0e951a3540ca97e7c4c2cf7263f867c6d70b90eaef097b3c
MD5 hash:
4bb0c669470e9ab900de03a3b5369749
SHA1 hash:
3b13898a7e3615ddffa0e0a57c7af6d3545c354e
Link:
https://www.unpac.me/results/075ecce1-4986-4d2b-81a5-28953696345a/
SH256 hash:
c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0
MD5 hash:
47509d9db24c975e55c287afdc459fad
SHA1 hash:
4f1f893555c985d7cbba731cf1fdbf49c6ecf793
Link:
https://www.unpac.me/results/075ecce1-4986-4d2b-81a5-28953696345a/
SH256 hash:
495007def4663dc1919915ba6a04bc04afdf9161f70a0a9664b3fa9ac6fc14a9
MD5 hash:
94061ba2f9954c7d81105e001a0a0592
SHA1 hash:
c1f12014d2322b64edc681e795a0e86d66ae4602
Link:
https://www.unpac.me/results/075ecce1-4986-4d2b-81a5-28953696345a/
SH256 hash:
d32c7f1f1813d19fcd7c4720f264a0f209349bb3093465f1650baafd2be1e829
MD5 hash:
96488bd0d076e47ab6ead1dd99da3b0d
SHA1 hash:
d096064d9be5343fba0f09471ca2403b04510f65
Link:
https://www.unpac.me/results/075ecce1-4986-4d2b-81a5-28953696345a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments