MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ca72d4bf88b667018f42bd8079f47678e3dfb0135a94dca3dcab84500490e5d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 15
| SHA256 hash: | ca72d4bf88b667018f42bd8079f47678e3dfb0135a94dca3dcab84500490e5d7 |
|---|---|
| SHA3-384 hash: | 591a1e76be4d8e13c77a137fbf27d329044be02883a63357a402fba96e16b135dcf08208d162415200ad37f2f55a70a3 |
| SHA1 hash: | 34bc8651234d58168124589acf94a97caf4061d8 |
| MD5 hash: | 0e89230203fa44d82492293a51980a46 |
| humanhash: | minnesota-kitten-cup-angel |
| File name: | SecuriteInfo.com.Win32.PWSX-gen.29337.28984 |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 952'320 bytes |
| First seen: | 2023-12-01 09:24:34 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger) |
| ssdeep | 12288:SekI8fHfrhdI6u0eCkrNK2XWtEAKzinIlDQzd4tOHWcxl6P7r9r/+ppppppppppR:r+fHfrhddgCko2GtfIUd4U2Il61q |
| Threatray | 2'930 similar samples on MalwareBazaar |
| TLSH | T1BA15AE84E5A45B61DDB9A7B11935CD3407733DADA838E21D1CCD7CE73BBAB824412A23 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | d4c4c4d8ccd4f0cc (241 x AgentTesla, 65 x Loki, 41 x Formbook) |
| Reporter |  SecuriteInfoCom |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
328
Origin country :
FRVendor Threat Intelligence
Malware family:
agenttesla
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.29337.28984
Verdict:
Malicious activity
Analysis date:
2023-12-01 09:29:11 UTC
Tags:
stealer agenttesla
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Ransom.CryptoJoker.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2023-12-01 09:25:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
52
AV detection:
15 of 23 (65.22%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla_v4
agenttesla
Similar samples:
+ 2'920 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
AgentTesla
Unpacked files
SH256 hash:
78967824f0c2b6a59a47e6646735ab1363663fc561a4cc6f5c6aa97eb3e5c8f3
MD5 hash:
d62590e508883e8883a7b18197365e8c
SHA1 hash:
36d057caaced67d4916bd834750cc397378e2830
SH256 hash:
bc99dcc182eaf17394c34611c1aef4ad45c3079ae116c19caa17620d64c39f7c
MD5 hash:
84fe0cc42b4f30e7b6f58c92f9ad3d56
SHA1 hash:
d753cc7cc8e2927f9cde57fb67b5bceebd2f5fd2
SH256 hash:
cd28960db8caffdd96be368ae34e7cf33c8011cb5537134fda26f8cedb8ea209
MD5 hash:
a900535125754036e6cca627819383d1
SHA1 hash:
d1bb4e3960231d1fc6be4dfda13b844007e027ba
SH256 hash:
d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5
MD5 hash:
579197d4f760148a9482d1ebde113259
SHA1 hash:
cf6924eb360c7e5a117323bebcb6ee02d2aec86d
SH256 hash:
329e4d9185f705b527c83d7f6d3b2bbd6a12da46a6f5d86f280e7c63650819d3
MD5 hash:
c58405d0bf5f7d295ed356e150d841eb
SHA1 hash:
828ffa40a073bb5ce854a3bb1693c811070b0ec1
Detections:
AgentTesla
win_agent_tesla_g2
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Agenttesla_type2
INDICATOR_SUSPICIOUS_Binary_References_Browsers
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
INDICATOR_EXE_Packed_GEN01
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
SH256 hash:
0e8a5f6bd3e915b9d2fae9428730dc5017348d23b622bccbb1971e352052734b
MD5 hash:
56feb04fdc8b0453c62267ac204ed555
SHA1 hash:
7d41fb41cac90bea85cb6691a5945568115cbcbf
SH256 hash:
ca72d4bf88b667018f42bd8079f47678e3dfb0135a94dca3dcab84500490e5d7
MD5 hash:
0e89230203fa44d82492293a51980a46
SHA1 hash:
34bc8651234d58168124589acf94a97caf4061d8
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_DIFF_Common_Strings_01 |
|---|---|
| Author: | schmidtsz |
| Description: | Identify partial Agent Tesla strings |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.