MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
SHA3-384 hash: 0c2180be89d5f1fc3e21ab32eabd4fc306da97def0c37551167ee8a0c18dd1b16d6acecd070690904e8373b42e68334e
SHA1 hash: 2bf0ddedb2e3b7f6dca08d3b9d73ffc93c8e8ffd
MD5 hash: d1d5c3e8fdf8df59741c797c0c983a0a
humanhash: jersey-twenty-stairway-cat
File name:cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
Download: download sample
Signature AgentTesla
Create hunting rule
File size:678'400 bytes
First seen:2025-05-09 14:34:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:j6iTjmcO3QFVDpW34bvAdzoG+ZEqMeXrJWGs9XI0JweQusQ2E5r:2kjmcYCVDpW3gvazv+ZAtI0xQTQ
Threatray 2'856 similar samples on MalwareBazaar
TLSH T1C2E4ADE03A36A71FDEA94875D168DDB583B215A8B044BAE359DD3B9731CC350AE0CF06
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
322
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-10033170-0
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=681e13de4a59e5a2ce035d18
Tags:
agenttesla lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Stealing user critical data
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt lokibot obfuscated obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/681e126e0b64e174c41fca96/reports/77694471-2862-454c-9b10-1219e9134bd2/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4cd51252-a128-46ac-bbe5-4993f30105e2
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1685887
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1685887 Sample: cc8yf92KVp.exe Startdate: 09/05/2025 Architecture: WINDOWS Score: 100 27 mail.mbarieservicesltd.com 2->27 43 Suricata IDS alerts for network traffic 2->43 45 Found malware configuration 2->45 47 Antivirus detection for URL or domain 2->47 49 8 other signatures 2->49 8 cc8yf92KVp.exe 4 2->8         started        12 svchost.exe 1 1 2->12         started        signatures3 process4 dnsIp5 25 C:\Users\user\AppData\...\cc8yf92KVp.exe.log, ASCII 8->25 dropped 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->51 53 Adds a directory exclusion to Windows Defender 8->53 15 cc8yf92KVp.exe 2 8->15         started        19 powershell.exe 23 8->19         started        29 127.0.0.1 unknown unknown 12->29 file6 signatures7 process8 dnsIp9 31 mail.mbarieservicesltd.com 199.79.62.115, 49683, 587 PUBLIC-DOMAIN-REGISTRYUS United States 15->31 33 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->33 35 Tries to steal Mail credentials (via file / registry access) 15->35 37 Tries to harvest and steal ftp login credentials 15->37 39 Tries to harvest and steal browser information (history, passwords, etc) 15->39 41 Loading BitLocker PowerShell Module 19->41 21 WmiPrvSE.exe 19->21         started        23 conhost.exe 19->23         started        signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-04-28 02:13:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
29 of 37 (78.38%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z3hdcyodu7fjpsvkjhtxjrubdyptpdg372p3g7qx7fj5u74oxuea._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
25a1241fa5efb1cedca9c984dce1f39ff7452b18e33b2368cdc830b7abbe3ea6
AgentTesla
2e1d8dd0bf1511be6665ac5739ae946357fd033b2e8bbac18ab1b9495c2eebfc
AgentTesla
99da41b6e12ed59550b34c28d2a84eae0a31c5395bd589230a368891d9053159
AgentTesla
a43a6421f9f5f7ac6ce878ceff99e594fadc983275f4f2f464341e5564784c70
AgentTesla
f59249e0421edc3799b01d06dfdfd1877edb5bdf70d777e9aafbcf5570f641c5
AgentTesla
f8eb4a77eb29f42fb4ea1c255a1aa67fa622a9e5a8f7440cdf8ea8b5eb1d0ca9
AgentTesla
+ 2'846 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/250509-rxmybswrt2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
Win.Dropper.LokiBot-10033170-0
YARA:
n/a
Link:
https://app.threat.zone/submission/678ce19b-e544-44b8-afb2-8ca742164300
Unpacked files
SH256 hash:
ae1287831e6c4c0feb35d4b3eb5b30bf9947a6b73bc15b97a44c35cff791ea9d
MD5 hash:
5cad655e43ea114549f30da2821aeb61
SHA1 hash:
2edca57d756c61e40e8bc755de282d8783daca22
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/74ec274e-a32e-4e0a-94f2-ebb87bb5779f/
Parent samples :
16710103bbae3fbc560ef36459df90649918b2b33ec96d0a277d10ea31f81fcf
682d77e301efe76c076423cfa323ace12a4adb04fa0b8886b154684f89e983cb
1ff831f648c1e5b70a5537bb6180d5a1912e5a33b79179a279b5029da86696ab
c31f10c979afe3c22fd1cc48b720cd880e0c1a4b2ea1e7af2057191058f410a8
4f8641371c70db217c573c922367c68f799e0e31a62e99404a59015b47baa67a
d1f2a9b4ae7ed0c866dd923d5d7cfab3a03af9e16f330a28cc66bddb97a0757d
dfae325223b17a4c65ea52dd31263dca38c50b48e814696ce39e871fffce8cd5
2fdc7b9f1318dd8a1fc040bf65c4d20f5f1df79595a59289fa9f4652151a6dd8
cec28fd0f6fe4e4cd3f7a2d28cee64322d7b4ef6a46def443d5c75d8969e2317
506d458de1be8c32adfa1a05c28cefe854a30e6bc2d1223bf27e4e36a7ab97c6
96f0384cc3243e0bf37abb7504f11b1bdecabed45a961cef490dd91e4040c19f
56b23a0a370244334ac5ddf297014a5af92baf07ffbc00fbdc43d29e1637e553
3684e368ddf1222829870f373194218a0e7032f6d5429d6ae80fb04638ae8211
d237d2765cf6f376713e70781f15439569af843ffef61b89fc4bcc11c4aa89b9
00d5c9aeb99d4e1a78c18bf375d4a47528e89951bbc11dda251d0c7b17c5d3ba
e4997c748608a44552daf6262f503b22f5d77e20bb4b411c6342bcf6c1690ff1
8ba17fe5add6400885d78698311fdc2586cd6ceba5578eb285ac64b77b065e16
f0695b975e0e13218720fb19aeead0d365d7dc99ac0d32d8b0227a3224cf56f5
df605c519f38938acca993e1a831fe032c1e156576852b491d3279201e62fd3f
ffe5dca9d94344ba35262a0eeccb6944b96375c0328b958796f8613149f147a4
be382be770efca98969b48895a2e7c41595a77cd79154a730db6b5ea9f0d2270
3ca964d47a615f318ba0fe2b31dd5301cfacf51c9fd20015d2a898901b3733aa
34de6cabde0575f417b9491911199dba9380977f10a1b7bb0a335a61c7a9f372
1f33285ecfd9edecf724b76378c34b1580179e5eb8a4427da3ceea6a44b3a792
728d076928cc7cd4a79baa23419ae597aafafbce6bcf3d409bfc53eaaa684952
b9bcdc03e3c7fa904284298f4cfdabe0770ea82907fc73a462632a75ae8efc80
fa1e69cb8993771043bd3086c917259601f912263edb53e2edcc29e99cdf54e3
a0908f2e12db17eeb19e8fed82af3f21c4026ff9c75157e42233136512f58c63
b4c6a4b1994014363f786838748a4d0e01832cda7d85c9c0ea73529c16ec9e26
a86ed888e10ea024b27aefbb9eada25bf7bf5eaa21fec5eb7a82d9123bbaa6cf
7bd235f539219215d5df194e6d2ba885366d939e4b692f97a194463ecad34d4b
240c09f1a97bb6068fbe9c61b6026c0997dc5f2a06ae80e0c15ec691f40f30ee
eaab91d22d868257b7e6d93e17b10336967a9bebd39573145f5830a4b7d0a1dc
33c9ffdeb5e94c9bdce7dc3d0ded74f15e49eeedf44a64ce454cf065bbdbd1a0
577618a8427cc363b465ddd0d06924799d820b32e2f4e42e67a852e072198957
a8f3269aa0125bd0093aac23495f4dc4784660bda3a4ee9bf871ab79d75e65a8
87ab552cd2d84cd5fbb0c4a5bdacf9886687d314fe67b2c47fff9caff4ce31d7
5f25c8dcfee56dc11e03d1001f7c46e5adc9103651771cf82875dbd3c95c6775
502954caee03e25d62dda3bf7ee722629dff96e20cc3be8478a669ba1a62983c
c37baca5c488614ed44b90ade56d534975201dfa94327ed216b3c87e3ff8cc7a
c21ea61a25ec98591e132294aa244adeb9467d4c7abc0c6df772dc1d662f4b84
649bef3ff15efe5ff2efaacd71117cf6fcf02d33ecee43b049ca13dd0b9b63a2
5271c1a2883919c00e117de2efd6832ebbac3faf78dd2bf79641a550dd244398
b4bcb99e73f47c4a4f50ea83580f6d6722b685fac73f9dc11777ceedb8d97f8b
c119debcb955f7bf495359707990716136e4fe5ca31b6f8ee27f4895afaa7404
99eb21753db52508e65ced48f7f5dae3fb00a288e22dd1d54df7bca78f394bb7
8291fd2e2188911c99865faac1cf303e8587f69239e7dcbb5b9444bbe21c9cde
009b9ffd2d908195481e9234ba0290ccbcff6457731bcf0c5e6a7d770a4077c8
94b6467cd5aea441330626de9ea2d6be92c349fbd4932766f644e461bacbda24
6f9b050c34122c2175ed83fbe4bd053133295c84610a991bd6a16940aa322ea5
61d063ef343fd9f0a449149d94cbe2d515ea50bcd008c56dc66af8a91353f4e4
1baa01491b76eb9d1e39b233dd2966cf7f1babc5cf6cab48ca6e40b80d87f0b4
37f0e1197e435fce2311791ff38dff3c9b1332e4485c1648bc654990e7a429d9
79d7a511c69ffd0c34847d5e459c9a8585e3625d66b4666a24212fb6740ca36f
6f4997b2a236ae5d05902e64165d6ab9a95b5055903956a24ee92e8eda908d87
6c3c65ec59e1fe33db808e362b9a58335bfa9d375c4b9e717f6c95dcba725f82
5c59105006959233e9ec2e049c3b7e9b4df0aabd262e37fa8ccf0154557b4bee
de318bd60337fc20d8b67fd07db9235adec03d3f6af004e30a4dbedd9c63bc2d
85eb3041d52eb735c82cd60b3a9fb25d404de4abdf04fa920c81ba400032e881
e062f61985db319dc9f4a230770e7cab783cecec8c61994aeef2d75d86942a91
07861f62cec0fd9054939fd5a062da7ad01d781a72057dbac6859c068db001d5
8fb11fa0364c17c99805db4165906bf4592c745ec78f665acb830755b2b18567
92d76de45d33072ac68cbb8bec478169366519a4ee7c9d295fed796886adde26
bb14569504a137a5aa8d5923abbfb57659727db4d5903da93e577cf7cb9fe319
15b1dd61220782f0fd48d6ca10e0a556e036f2ce0450e443ee33a57fb6dd4ba9
ade03b33ad1a47b43d99a5eb7f469d127f98df657167c31700fd3c5cc76c522d
84d43d54b0cebab94fe2feaf56e7c5f223df6f7bc1e71afc12760989c21761f6
922a35308a57f55fecc984dd5f8008360639a389b8bf37e46c0a14bcc8d7c8fd
8f19d493ab01745e743d2781b610c2bc92a959711bc6fdad3d3937dd0d334cb6
fe3589253a8fd6aa4adba398ef62b6066dc076bf610025d8b05def15ba3351f9
7080b6bd8792eaf9753134b20ce4ef1e7bb089bb62c109803f2c12c674194675
95ab39eaf0c052142e609568672d0c472c87cefb1b34e974ff92935bdab75a09
6b4458f800fe38459a4246d7e08fe939daa453ddf95cbd6821ca2e32adc121e4
e3ecb9d4d5f679d7928ce68194ab19fb38876f6c5e72cc7d3d58fb708da26a3f
0e2e5e933088b8e54067815a50b38d0dbb7430ec61b1c3ae6e3c9196f660666c
373abfde84867e8ce9ee0d8b4619f746cbb749540dcaba53fa0a544033db7631
200106384688b9efb05757f00720f400cfa27135b7ec8f3b320f6466fc2bbbed
4ac0bfe8161d9f1cd6e355f8b7d0793b12bf610c9114d6bef8bb9c22ec1497e7
f99cf9f643c2e4d0517b48a35721b6b6df1feb97895c476650f3364d55fbc77c
f987997a15f2ffcc9430d67e32f54171fe58e4c9f6865146b83cbb79279a0b25
d0bad580ed3fba0f80fe09ba1778ae49fbe29a0ea09548a70c49330e24722665
2678402a1e4a4512e44561494f1c7ae7e30b86e5621fe722f183a6d82c17cb9f
9fb47b33659773bb9ac4b4c224f9dfda0152f8a062a4d73f2e22c6db694e3473
b4f779c06421b878976598d11fe86b9cf3b92a04d93c9ce11b57772876ccc2ba
4cf6dcc350b1f1f3dc9aa8e72601e9c723a878709773dac955c408d280f7a729
774051024bba00aa22363a355ec0b76518464d82eece577d98839966dc6cae19
10e7df181627a2f66999dc4bf87095501b2e69833efd4ea6262e27f0b5b4b272
b7948a338d06c448aa9a7377e527688ea5438f82ce0bee447f6ab57932b30ae5
17a6a498aa82d15f97cabc8a7a0277b2334e2a0edf5d315d87733c6339194c72
861b9d85f642873dd0f034f6f946e3791c4cf94c6687527320d26a2f217fa04c
afcb27b266ed8d8c78cdea743c59abd521bddf2eb56d3930f6b1c4ad115627bb
14bec9321ebe46e28e8f38d4dc2d3ca9beac7e683cfb316a208fea291629e77e
320b021b187d07f6f0b7b54483430e85251f4cbfa9fe32ab63cd8201ed9a0678
0f9eaa5bd9e8297ecd792d9b31345262be954035ee6ec3aa323374297f1f125f
e2b1474db72b91f6e9f35fefb2c9608a5371d21e519e392344d5246b7ec062fd
91627eee26e26e9b35346679b12d9ef8a08d74be4a8b58d312d9b36960cec7f6
5e47d534bc69265885b633e57144923a33dccc9e6f19aae9b1906057fada4ef8
be83e0b3f35f8c1c74fc219587b3fb7760ed49a611c5d060dfff4e5853df6c0c
0e38d9391f83ece1c83fa94f5190c4a7a446feec38f305707fbcffd56f881892
b9e560839e19d9fc3cb727c4dd29a81566162a924b9a8ae5f55523284a243cc7
b8c9775f98ecf9d5fc1c9710289f2ec6a843e9a374a34cf29c53e21471d4762b
56ad5414ed2c3a9779bae69c39ecfd87b8c5d655af701b147f02eab671c4b6ec
31094d6d367c92b595d8d48818b998fa9d3c6114e25b48256de8621a2b5f2baf
03ddcfc0bd5eeddecae7ea59eb8bb9bf08a55a1f03784a3e09b99df597149bf2
6c4d270681da5377dc375d3d4d026eddef87918f6613990f0779884b794cf415
34bab60d1a03e397c209f4455d1dc0dc6cd2c1a5348da1e0e99f16e069723e22
4f111dd6b9cea83f8647ff3293c8df2962b052faacbee349867bed985a4703b9
e5f629d657b8baf55380a2310b6355422e8c3092fea3ae757b3c4efe3c6e8bbd
49d2dfe9ec5ba7a99753d71a6c091c185aa7adb5f4325b08219514ba1e6cf456
41bb59ca5ad601c85e0ca7ca6233415f010f4388a7bcb6180d922875a258addc
d6ff37cf17f73dc09e1bb459d7ebec5bfe3ca0acac5924ebeb15c01e1d5985eb
bc407aec3c1515d5cf405c36da5d2336361e57dc07afba016a5a6379b56892fa
8c87d9eb60632c48c1c1ebf86eaeacbc397e4d33a72c82bd9c4d8809e5096102
35f56e6019406ee4247dfaf7a96e210eee795c8b05dc3c3666a2f644a8d4beab
e2c38e07a5c77d5cbd006efb20da82c97a51ff450e2281dbc11d13541ff04041
ea686a707c6f103860a3d9fde1357211e15b9aa8d089469a04d2aa1db788727a
33ebc1a99345339f295f40833f9a603c278d2d7fab7d14d4577a1273689440ed
f7716c15ec6f2fbbe55ea20de84f9b2b2c5c985f65aa7482a1aa7cf8bf1d06d6
cdf4628b66669c11801084659542a15705c73e5bc511bfc44bbcb8f2e53eb9bc
490df09cdaf2bc63fbc092022717eae73f7ebd54ae6c7d0db3f2a8823843d192
ab6443a215042b7eae0b57326750dcbde20b5b6991784124f29afb192c45f7c3
c16db060e8233abed92109f90b60c07a36acce85bdead063d887f89d2e2c1cc0
fef63e35d792b15a6c741896dc2998e9d359ea97f3ded6b4dd48f74ef48ebc92
faad2001e21503cfa4015511f761b5db63c6a1e581d140021359eb60184ff222
b7aadd054d5fb0c87d9b836a154694668291bcc1984a529cbf7f1dbdaab39e8a
8405f32eab91947b14c6411f949b265a1a2aaddcf82b1456f78698f3c8f50afa
5d9cf119c0e1d06c3625fe6b3f3c2801e2bf8bcb38106687ab961245971c2b91
df26441999f9925dd10b83aedf9103bb451949258b348ef1be5bc48755019c9e
64c1ac17daaadb7279a761edbfc3f8842478d61e6f2c9094e3859b4c42da02af
e1e626cc22627d69502270892cbcde3b6a6cf6e3326712b47c736cfa48dbfacc
72a10a903b9644206b86f80339c21cb454327f3afb6dfe63c939d354fd2af317
248bdde1eb2fff66b037200945c95b22c3c607aaf3c422b8523304a44c0e99f3
5ba47fc85b0a155eb88dee474eb149e2c31b75f2b5df7a24aad699dd81dae311
16197508cbf20d23fc248e0f533374f28162d5c227d02956e04f4031548c4cb9
6bdfc7f271661049f01ed2bcee714bea49f1e0ee604b3d4f4d0144cf39d5adaa
5ea761dba0e351f275464bae5ab9a2f5038b83cbbdd55113ab1ce30f1d182970
8c26b8e9d4ec4ed915142dba3a477f1f6490b25c7e72973501bb468ae8073d59
049cc2d1388dba66dfeb9fa5de703c293b681641a855d13a8cc1490b9d64d8ce
bb7306eaef188dabe0ad73b9346fe2704a50a0e5e5f9557f365daa6a97a09182
ee4202466c3df1bb44773ee382d9814bf0daac585b416e44ab0eeefc7a588aaa
eb830905829e3aac092afd0c536f9689998e8583a697128c101ea999e20b4aba
457f751b9e2331ce4586c67e13dc11de41be3eb7125197afb260394273d5acb6
d72e89cca70f53abd92985796b73f8913a342f6caabecd2d7dcc44de97b15638
6e9f1be5c0eba46abe922cd9b58dd67cf2073820ee6cbe2563e8b1fc63385855
6da71f21f5ce6bf44c9fcece5f8f685e705bc622e9b178658885cb5206d23078
715eff2e71cf1ace027a6b89656abc6aa127db6f6004f7dd10c32ea379e994b4
712a2a2da336e127eea276d37b664f1d82a0c5a94498a051021dafbc8d9bc591
b342eb87b5824c0c867e6a4fccc6c8f4c7a19d3ee8c75236be0adfad477285f4
19ec5eb482aac74018cd2b014d941a242792312c809d90be93288afb09330ac7
489fa1f06147a1d21adde71bd24108e0d80753baeb4b0ce2975d482410b87126
aa5bf0649b614a83ddb9ecd1454504d9d51126f426a9477e5a407b130cf80983
2e5d68fc3cd969cc3fb393afab405b214dd9b0fd7ae40eb4f49142397a00896e
26734c4f5080e7a15bb38d290173b208b7e872f923b4307cd201b2a756638880
e551928c5596eddc12863c8103bdc72fc53872c7ddb1988da7958e01ce21a1ab
572a8143626c3ba4a47ab7ddb26146c0de475ab3a0f405193305348cbc02603d
ec3eeb4b700498a998d4e5e80013d5d6e001bfb48232e9eef7bcca14b40d7a06
9d98e890098a67a4a0337c250088898831c3f39eb00792f4d036b3d439c7058e
781bbdbac8346f7e9d5b1530dfa2b8661d23b18a642bafb358e868c989760abc
0081fb53ed71968a848d5cd1f8a19baefdc97c1e82c111d844fdfec240fa4f52
27692e445216380a00c979161d2163a20f71513c179031a564e6274078d0fb03
5c29840575f0782ccd062371831a7eff2315436c0f1eece428e89fb6a1d6734c
c089cc6b6ad04e62f0c135710beef0013f1805df94d54aaa8502d39a265bbe61
7720932ac03ea7d847b5d3e035c4ab37b31bc4fce71fd6e0043f5149db231a8a
80b0836a4f3ddfcca0e16b9bca310eabbbad53ffbc2ab1a44913b590782da2d6
912421c5e67b1f2f502b615413c02a9e7c9d92d121baa694438ab3608b4b9f88
ff3f5b0f417e56c82fc9cb1340db97faff6149fa5b3c9df795fd91a40c509862
f00ac8907fec8e6dc31725e4080b6f4a6ec48d456ebd7e58009f24bc8e8eb3f2
110962df85578b3a3d46ff96d15966c0365f885f087ef21928e605fa7aa164cb
d922cfc7b45d17c9175b6de4653c9d7e62c8fbc390e6fa9ac294598a1e80c7d8
9569e962638eba6f9bf00474c616841bd7de003fcd5928472777f6c70837f73e
36982cd1c8dc130db45859545ee291128551060bf306217d6db4ae2894145291
5a7f0a0cd553ea494cf5b5b03ea5b81273218ce2b6132fad553ff91e24186811
8a950987e85870f393f8a7b623d826e32bd428c2f0d0f23112dff46066a7cbf2
35850ee5ec4788a4a2af929b805891f6bcf339869ec6c4407ad011ce7bcab4ac
02fe6d2d4a41946e2ecb73f29778cc3d94c30e53f824121af6732c08bb972419
66a1aa16b5484c0ebfcaf2100a347630697789b74fc9236ead6405477dbb7c50
1f891e16bae23d9493da67c92e7453b935aa95e815e6baa9a915c2897731246a
e309f8f28059b461a715d458825bc7e00b9e5606eea7337525e9a074dc9effe8
5e4675293aef9541e937220098ea561b15c44d2e22d8ac1fe3f4e0ee8b5aa09f
22bbef730c3e272f875e47ea0d4e8dc1add0396db3ceb6d86ee2d2e63c26f779
a74e18b6647b592a00068d8c7ac322a0bd617e0146ddd1864c44b8d2e8dacba4
fa64bcc79223407760ead3b9b78477e68fa18f3d65ae6c025fbde01f11247deb
efd056eb7d863e93fab3ecf6a1609d7c94ba5ae2e43b66204756dbe0a77d37fa
71ea55b141b72865cbd1c242256d71b7c5626ba9cd8533d3b5ee31f7db05599f
458fe84bbf2d7cbda5492d6517a134caee56ff16d888ed66b84722a9aebb76ca
8e44219248894eb248a11f54284a1c9b999ea0177209907f868ab8bc2783b9b7
174c55d7a28d85aad633a9d88c9e4d9946f28c277f3e793ed9c8a3ed98f869c1
553e57c67012138259009fbb10a4ed4dffaea95cbf154ef08fd02527ad97654b
6b1f5f74b6c2d96735412a65813be19b3b7d5303fc5bd43fd158df6adcb17c2a
86a32cb0fb642641f2b04987043472edaa31b283c437a64c9e0fb7a549ac10a5
3402c7e91b77a6afbff723873d40d063b04e494303e5b4443b29ca3d9bae5ce4
c580a68de9979980650d0ac1aea463cd970c1ec8604e6f419e9c057efbbfdf61
7cdb8fca5128be15e68fddef81ca58e6cef3e69f38dc885c6c413786c9b9f343
d63e95b7e4b8abec5bb4e3228f89903cdee6b0b8941686cb36d2ff6d50629359
ddaaf63a37f114e42a1548a57af2f9024e9f2e143401366b6351c1cd4d7963ca
46962429f9a17c760f25e988d2533164228f43484560298f6cbf030f26455d00
2af4f4e9c66b1153755eadf264c48ccb3fb55abe80ddc12c245f0109f18d6806
167439ff294d88a478d4c3d7045ff1d8506486dd97511daaeae95b9240f30961
d4b8c9f149cc269c8aca799dd247ee525d33f9d013750f817b4f858691ea5b99
b23029bbfaee8da6342356bdf09d9242634c9b92bad625d275da0135bb77f55c
e3db4470101ffc0e0bfff6fd7b9bc331c080702d0eee25733e793380ae3b8753
cff11adc2348327f3078333995c8101840ca782a1da1f6163a366b8a30a5b000
7cc0fdc66bfbc65d8d0035e1659a6bab04827aaa980d753d83020f1a9e3549cb
e95865bc13556c4a7666003b4c99406536cd9f6a17f6706104e707de3744bf1e
640e616659d0c6fbd1abe58a888cc144cc0026c625dad72f20ca0600fb194d50
0c0d773a601757285e5a3da3e8c45a6bcd4d66ac0363397954de172c8a2da704
60a4969ae924d6ef3a9604293917edafb3ec21ae801fa4251b37691c56295956
0cb2fc2e6a5de76b308f66079db3794ede4027b3c25653688654a9549f76dc86
d0259ffc2de3540cde857d4579389224de5c865df8bf299ae41dc9048a9cf546
eb2e2da880054567ab4736150565fcf7353ade196a8a500ef234f9a9094b9996
0ef5a44e6cfee0bc94b6aefce53c7fa98897a204fbbe59a58a416ccd8c2bbb14
710acf0f0b0da3df593a77e57a6def732030aa047b6c7b97ef116a04721f0a32
971cced569c6dea4431bdb0111654978961b84264346405254573c27215e0633
93297db87475693426faee1c64458b55d362823dfa14614c35b6650bc7369895
0606808ed17e9c16e0d11496b50484a2dcbd1e39c364659a55a946ef6b80c689
8aa9bc4b48e64fba1e1167eda865f7be096d9ee541721cf5ffa7cf9814f517b3
fca8a83c6fc8c413126b1c8466c1d4760fe4f5e354e7ca843c86cbb417cb20f6
ccfdbc2c2698e804cc3e9b200a6ad61d835b7b0e2aec1aa4156b025b7e9e7340
d6a89c41d73e93f00a90739678b1b977f81d6e0edde500e663a4400065d6c3b7
200028d1284bf0590155f241c66bf26c43661758386856a23b640f92da28833a
f960bca90abce5900c28180953467c72694b67d5e6d0218e5ac6edd454eab572
31a83a4477bc742ccccec7cd1ef6cf0b56fce9735efd420763eb1ac82ed81842
1a1670be4580948054412aaf8daf08bebce39d9a93ebb7f1656d15b569b9e707
a7485e9ab1ccbf4b337a2dc2b8b7fa95c63976d7c9886a43698ebbf1493d8c20
dc4bf2d8b23e74283b96c26dd98b0e8bbfd1611a51ec5ae47152527f11a226e0
c9d729c219c8909ffd7b6cb9de88e649c9e1df24e488d13752fe93bca352785f
0ffbd00f4410ebb5f3960c85150bda3cba26211c5736e5c9f57c39919323fd3f
773bcc376bd725ceb2bb00ede9541e1f267fe302cc40d8d519135bc0a830e214
da2b858b41f8cea09faeccec9284352b1403c1fe9c9f5320fda75c6ce41738a7
920d98ee99152622a6ab638d261e6fdf632c7f4c276706d7523bea6476ec561d
3c214c666d427c74d7fcd6434a03a5fbefbf5e1337daa5a33653da0320878b76
8ca0e41da8651f9fa36bc0a10df4445d609e778c05e9de397bc231f097459593
7c968428400818ec67d45cb4bf6b4bc83bfd37bfb7fa95658b05d333a98a54fc
fec56617a813954d1022f62e9b2755711fac4b5cdc6e1caa445aca1f279bd324
726071ea9188c81b141153a3dc8c2e356f3f789bb1d2c4672091cf3562158d3f
49e15a9ace08da2ee62f808c51dbbb91742fe4d3262fcce88e84fdd50d813abd
daa8984b462a0e7057a9641f0c54ec57f918ee3cca607ec1afcbbc1b66f7f73f
351443860dfecb08d26186c4314dfd38f6182e0bd3da85a9dc14dc0bf6d1e783
80597422cfed734ee2786723bf0448604c6f04a7b7e3589b7560b44af887f999
a097aec561cd83143a72f7d65489c7183215e3a1297972b149e045296fe58f0b
8872a45a4dc167bccd6bacf7fe7a2e1226b6d0d715c254f70b2d11861a580c9e
53a4727b9456dee6c0569d912fbc3184d953fb8009ab380204cc9b72ffd36c59
3d23669e6b8b3c81723e8d708f6b96775438190207a7ffc2b3250dc8ad9b6d1f
40c6917c29ca6cda32661403a08112ad7cab7e8c3c0cc2f2df43ce304fd2c9a1
8f70dd4f8cba66fe0b0357a900da20e6720b9f61b2bbba69839989b58190d559
0b61c4ae0bb0013d79d4720f22c4f938e8f293c037da2240a95e74796e986cb8
34c5244a7fe3a0020fd8076f8cfaffc646eaeec2a064fafde629f32dd7d271ab
d11caec43b34f3572ca3a4d59e2d017c913bcbc4d285ab108cf20f1a35916b09
e447fb203cee5c45700a06341f0c43bf8103524239fdef0949952621815a101b
cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
107a426d4bc60b1e6ed195a62ad0d6d44f63a6325c64d3e8c64d6a192f05dde3
ac5e423633251a0ef1dfa93455cd0815c4de66e5dad883d0ee5585a423b287a7
139b85b4080a02bd329b10968f2a0365e7769f175e60cc7ce1e4a98af8afd41f
ed9560d7b80ecab2224cf3bc6f60f11108e75f73df736939e3c3a1d4e2d38300
df78f09195d5ea7b410cd19c7d776da01b8249b92db4737968f65d5fa557d5a2
85aa03ee749d1d7f49bc007a396272be71876668f48b6b24d14f8f783d9950a3
3d61aa0e6fba0fc0d2c41a61f004fd50686dc8bdf86b436b9ce113c140795b8f
1aab9cd5703cc04fa54ec81ceb18aeb93c6f689f1135e7a05b99999799212a09
f9d2c41103ef693a7d6faa4a3a398a80f0b79192f9cd74b1b788f5b9f7086e4b
54aec3664b3d47bf3b85f344f1d1f319e2c3ffa88d95442fb7dd6a14f401337f
eae3a488561ff1bb895b0670c0246d254f46c4c32efd8faaceb80e275bc10bb4
12d18151689f567858b9b70740dd5ea1ef379c5bee30384db4241563a5fd6e91
15b76fb2b2e05959ffa7fc6bf458d8dbd7552608c03142822aca07c6049aa1c7
95c0a9a80b1593f42e9b2913d7f23dbe35f801312ae017e5443d3dd2f2959f0a
1517fa5ea2f649735f110e47e4b55323b441718a7e6bf7dee66d27188feb9967
139a3b308c771293d9ab5a2e11cc9f978863082e1268183da77f08414c07c9d1
a383a743b2d24273fefc0a38a33669dce721c91e52a6f845e10d1b36825fa8c6
b17813b2133fd4fbdcdff9dac47d794583dfe73860ee824d1d3ea69a5be2ecde
04ba770c55cfa0531e93dbc85974db72e8019aef649b59234af9dc2d209d0591
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb
bae6e5e9cb4fe232463c52348ba38ccb1cda92f61414bb27b9edd8743197b927
b42a5dfc1af1fca35389fe545756943f0f1de63319a85dc506d99b09ea361154
9ccc75b6167c8c2d0bbc589970726bac57ed8427b5743487765d95782cd09b9e
0736cf7d1a00f10c540cf2c5fbf279c2d788daf350eaa454bfa079ed0811cd17
652a2564ac5fe8c0400d7d3913f516a62c702eef444d6163cd8d3681e6ef97d8
9c70d399d680255b351d6848195098a67f6b06d30bf7b0bee77a2e9666ee5bee
723dd16fe999e4370309cd38ba3e0de8fa6bff08efd74ad952e5e4c2930c0298
78c1fdd8c368ecfea9e0b3fca5c95ed3c5fe9c61e8a6b33ba99391ac229f541f
37055616d9baf9634128ef3f41d36ef85f37adb1cfceb1cfc1476fe7bced51d3
SH256 hash:
2df08e3fcc7d363c6c3d4836f420088903c2853f8a6243e2d035c40899aecf54
MD5 hash:
fe9b94bc0027a4cb1c82a55191159292
SHA1 hash:
f28fce2bbff4aef4fcafdbe538eb7d26f0b3f061
Detections:
AgentTeslaXorStringsNet
Create hunting rule
MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
Link:
https://www.unpac.me/results/74ec274e-a32e-4e0a-94f2-ebb87bb5779f/
Parent samples :
c30918e678ef92471a950450fd052eb49cbf066fa37a42bcf9c70b4a7522f86e
c88c132a285ea816d2804c27249cc2c935865507f094c8e73c27f4bfe8a87cf3
40f520059151169261544437b55034ba75964151f2fb4e931b9c5f648672d70c
5f60065f39cfb14defcad05927bd60aad0f5dbca0977a88cf0afe78ff31d5c63
e15f9f1f3757325a4af0c327a602598d1f52fbaee85a0a1e370b7437ac3e9ebf
edc7431f81049c3df92735f6834e59da7a2b7fb3f1c9c7838d0ae4ebbdf86cd0
8c87e92f4606b57b1292de938a18cc24e181b521092b17800f8909eb9e135c13
e08afe506a39a4bb08a3e299b56382cf4c1ef488b723fb45525dfaac2451d2b9
21ea63d0aac1cb7fe26cc9693ba53b931f227bd26c333a622355ab218059fc58
8f4c439db759beb01af1ec4d073406792073028abf8fbca33867396a499ca70a
13e36dd78efbec69aab73c92a926ee54f892499fbe5174442ef912731352a839
4d2b3332bac8fc3295fb6941f27014b6655c4f854ee6efab83b33652cfb463ec
46247eae2879b89ccae5e98acabb802062b6f21dfe86eb604ef136c2bcaf4958
484794d12f8acdb2894d9009c17421bf0b5be491eb43273f35bdf56295b26ff0
96ab76c69460cc8d8a255ff6ba2fa73091856c0730aeab47cdffa43ab8249c12
2df08e3fcc7d363c6c3d4836f420088903c2853f8a6243e2d035c40899aecf54
2e258ed170965c8d26e5e284e9b6f0204b7be36b68dc0221d11f1a446e46e153
342761981c08642199e312e11dfb8584c39c36dcf0d9829398b5de8de6302155
f59249e0421edc3799b01d06dfdfd1877edb5bdf70d777e9aafbcf5570f641c5
2e1d8dd0bf1511be6665ac5739ae946357fd033b2e8bbac18ab1b9495c2eebfc
e30c2f0a1b9801273948018c318bee81a6a202f4c2411682186cd8abd1ac387c
9c5c25534452390522f00bd000ccef1275b398f83e60edd5c1243cd0666e8406
cf3190bc9c7c3db75b48b4e180a511bdfb62942591540f88ddae24f2fa3d049c
4072d54cdf2a168636a24c4063e56694d071dd91d4337f2413d762841d5ed1ea
71150325320f5fcc0563996a9cdf89217e8a743fe3a75e754fca5fda5c86cf67
e47231e1941487788c99975572fc9fdeb6a4948ce8cebde1e3def61ce628fce5
a159bd480f79fa31be7221debd26ef015e4ad69efed117d9b2892554c73f57f0
6819d0ef008f17b3bffc407cbc8e37c43eabfdc39bdb10029afb535f542e4d86
ee4ae0633d4f95d3611693174a516e4a4c20dddaafa737245fd8a7100a49b9e8
21a19482c7a1a678d0797850431815d7778aaf3c76218e154cd36f13062e378a
f8eb4a77eb29f42fb4ea1c255a1aa67fa622a9e5a8f7440cdf8ea8b5eb1d0ca9
169ad5c33acf7a4aae70046eb2ac4e8f60c62c236065c616277b827ea4ec00f9
e1a098790e575bfbdde1957b2287912df823590042759fdf8e5e2adc26857137
9dcffe8f3437c5c785db60eec5594c3b22ebbec969f02de1ba545b3a70a648e6
f84f0208e1ccce6876611ab8d7e4c92f4e02427e9a72283f5346f98bf6539160
4e10c6fe5d0f656aab6d41c6a359bdbf658cafad4866583c8872ed60ed3018ed
a942a5f750e75de35ee750458c6849bf62af8867469873c1ae097a3f6cfd2ff6
5e1482b083ef98d77ee7c436a9b074e942d605a9b4a6f6c93c0eb65c8b82e359
ddcacd894280453eff2a06fed2994e57b701477c7af50d538f43f5c40c37cfdf
b17e991349d87089f0a98094f780531ff8ee0b89a2446aeeecd61eb77b2c5423
f7e3d289131a067c332064bd6f6cb7d336f0fb0476af14eea1d1b1a7127493a9
5ca87353c4d37e66f76875a46235208796dd620ad3cb7cebc6b5e66be55b2913
2581c92f9d54cdec17c02ff7b814ee3f7411c4f7c5e6bd1e4ea95431a1217a37
4af0ad255ce753c34b265d5714681b436ef635cbfc8dab10349ea913547be805
4ac227785c3f1cdd4b05a9d2ebb94e88a4af65303833c4dbfc35113dc21c97aa
24565cd1781c0378bf33859bddd21713cf1b624d2ab697921341ffb2c995e456
9a71fbe977c8db9b96f804494901b49117db817bce171818140629a345b7eeaf
4d62deb9e012ee45a9b2d5c90a15955965957d3c8065b24efdde65a9c8a33b66
d7068c23337a266991d88993f5b73c093a8b864f8f90359aba2026c02a1d027f
56b1b13bbe42015f512de69de47af0abda07316f4edef30f2c1ebc4c5bde5bf2
5c08922622153fcfa1cf05af7f0bdf474c6f9990c4f529742516a03362675cc0
37109eb42fff729d1786ca4b676167f7acaa918a4abaf3bb465cfed6efa2b134
25a1241fa5efb1cedca9c984dce1f39ff7452b18e33b2368cdc830b7abbe3ea6
75d0f8641ab2d7d47457fa1f1eeb338b2aacb9e356a539d18780c273d5a37a0f
78fe38ba9a5ee5fc0156e1d2a7598597f0fdeb85bba64c86bcc36ed9d1d24bd4
fe2ae83c4440daa77bdb1c5951efe680fe1a2e41209ebeba1ae72792d9c9ae06
a07df7d83e05047ef95a78bd47023a60c53414cbf1d6cdb2bbba7ad762675a28
2363d23876a13f38f92ae169c04f2d12bb3ab6a027b4f46f144aef5a02ee0105
68729fae59820aa23f3229fcb7dd8a438d31e3635bf621a1f53a8086ffadbbf8
115fc6621dd995b238916ac8629521d718fb941f0b455f019c85b1a4174f47d2
05d703bba8967b2bbf708b1c91e364b99e6b2b8f18f59fa07c47d4da47e0272a
ffd7d83a9e5fae75ed025a5e148013b4d3e7da5817bc715e4e0451a535d5e507
e967eb5ff57e890dc8aa2bfc44a97c5016fd2c514590be458e21cfff334df6fb
8c7a2e6b92c3db88ad183a2a6da6f523be61e4268782fa03c7bd4143f614ece7
859ce543eead04b946a2d77d7d2a9342cfdfad1698fef1d442cb51fe6429eef2
ba38c374f40119a4acbdab2bc171043b87bae2d299b2628f2a02da87e851c97f
3bd2b14f49671769cc1b82ab8e12b1dfbfcd126a440a58e75feec717f036e10b
dc87604f1d5dc29d3aab245b6384d1886819e53b48118bbcf8df9fdb1b58dcaa
8ad4cfc5910c7367a8d9e92d4a1ebbb02b659abef458d8ee765ac09e3e46a484
493b28fea1ea39199b503c952ab4efaa8fd3ba5a5d5a2d9df0af21d031f3ea4c
348a670a96b8de07cb4c376807d33bd7badb5f747917dfec6f3fbccf7c966bd0
546569a42f00553d7fda79e6961779afadd95ea8e6a8738ef344275f2b642244
9388d14c8bf0df5eb6607f66666d959017e45e01ce0a22b32dc7796b10cd080b
4d25a079e5c17965e6f79e9f47e122aec5b86b5a963525e6c1886d8c7d532e9c
d90ae55888f77f6914a142f25a20a441f6947cc4074f17cf8ecde99d41273525
7fbb218c97b61a5da84737c2b149277bc2d2c06601d891704d16924005379a2f
3372a33e02069a1a01adaf93b869ed66bdc06cb5b886e57c6f81e0243d6ec3a4
b27978ed194861aefac16772c229ff70288f71cc59611679eae88035a6c0191a
269e25fc0e57a2a1cbb6e3f01936142b4c6e8807d7e33960e5e8baf38ef3b631
420e0d791c2e5de27eb45cddb00321f7ba3fb3c2a735bd98d440345d01a7bec8
cf0640554fe636e6ad2983b7c61a4a62e3d368080bef6084024e23e7dbfe9715
7f24d1a1ac882a4e9da16afa9f05464cc7b4a59aa42edd8855543a10319f5be4
03d70e61c415e7a0e2ec76c31cdaa056d05ba4a0c5424611df5b5b69c1415ff9
963574e90ebf7786aaf6a17966441068baeadbce658ddd2f19af9a9f3f34c7cc
42db38678ebdd31dbcab40014ff3b96a8b263f77e8484901226defbdfbb8eba6
ca43a036727274823265311a9995eb0c70e288bd44c5655a0d231ebf108a30a4
836e1a1a93d29eeef8a26fd8001cb5efe017c899bea5c4d404db74cc7e6ea563
165005cb8423f38beba5461a10f3cf5fb69304013b5033463265c5457e48b76d
99da41b6e12ed59550b34c28d2a84eae0a31c5395bd589230a368891d9053159
9ee9ae311878a9fc88d891aeb7282d9633a90bb4f3a8688216fa3e12e4f33bbd
c015ba3cf24ba3b9a60b53b0f36fcf3368296c4951967ce63b3e6a6cfb3e7472
7a67d110bc1f15c95d420969b5ac6a78ae1d3c6d0f7d4e913af4a7db142a461e
4c325803ce0762bebcec3327635377a360e221480c99e1a95b708ed224b22cea
c071e52c0f19cbedbad1c026a30b9a2d5f6268c8e9a742c802f322bff7fcf372
62c012d00a605e319f4b61150151a4d811b80472e91ebc4bdebd5d98035250d2
efad3269d3bd9b9dfea3c1553dde89ad411d4dc850ad2cc9268e291ed3af1c6c
76ee39157442dc28e64f089260ca42ec5374ae2fccb99d0940b9717e48e6dc86
11013cdd71339c3aac7041ef80912c8c03786f5967d58c539af0d560687089e8
2791c4da37ccfaabed34d36c65d373650dcfa6db4cc8f2990d671e1c01cd74df
3420372e13d30995161a73ca1b87f59273f2e9986e6763b87527d91ed53df8ce
137e0a944efefef514d0595cdfade088a59eb12404a1469e76cd024ebdb2d1f1
aa31c3c2ad5f799d3b7d964c05c4a066921ef60aee8b3f96b4c95ba38518c692
8d8331f4dc08f7610760e59020a52423569dbbc5e7b03efe8026917f4905d19b
b612dbe8660225d074563250626237783bfdeedf5bb38d5af1e2789690787fc8
3591cadebdbbaee9e75158d085435cf81ba8cdfc5c92b050275f9b490ee60998
2abceffc33aa61d03182eeed898d402dcbfb1ddca4d1e6ee4b0b0482aa4f3b8a
e834cc0db159080a88d07c5e1c843905f7eb1f3b0b48ad1c5377f159fcb5e5f0
5b2d21f50ea195e247b45b8330c18acfd0f71e146fe40489ee8301c7045daf04
238525043acd0e92e92f6317fdadcb469dd26ef5cd7460e0188a673165ebef84
a43a6421f9f5f7ac6ce878ceff99e594fadc983275f4f2f464341e5564784c70
e2fed3e4dc387c2c5ed61ad006a9c346eca49f388636d31e48e19e81469d365b
4b669a9882308c41461e55b5c429cad387b139f10c73bf23bf4181a6b42544f9
5bf7b4330d2d77e12de0b43fbf876300a792e27fcd01021f02215a918781f61b
128eff6584a219a06cf80b831dcda899a96695f279e039dee81ea862aaadebed
e25b37773835f8846b990e84b23d62fba6130042452a4f43d4a8b3a6ed0c25ad
6a3d938b7100e9c39f7090db739cdf40f4f8e951bc39ead4d7b96c59c387df4f
e9b903a7b8f21807cb8025db679ffda1a2d8aeaa8de550259a7dd287493c8bcd
7dd6e7353eaa5327ca69dff1d7e598b3f36240aeab1efcbda34b295d9418ed15
cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
36dc014cdc1ee051b88eab111948730fdaaa261506d32e2013a34a2aaea0e647
4bb06d5adcee687a9935287829f07670fc03579b1761163926f8f92c72173295
dd8dde439f81fa4a6c927468424e86bd039b0e7d20ce6bd0b64aace0a4ac17cf
fcf8187bb21250eb6f8bb655b18684b374c6135a2696c0f026da4dd65ea82e5e
ae818fd422d1eba54edfdbb1043f749b9931038157e3db1675d7c17fff3d1169
f532b6d77041027a94bfbc117759218899faad1441e4f60b57197d0a687b9240
2218994e51c15b1b3b403073b062c895bae9704a3255347fcd07d5a0dc4f217a
ef0d48f4ab28cc338fc29affea2e019f1aa34a54c4220b19a13f57f73f9f81a3
a21e5885c3e892eb1f2adec7d093935fa7746ea10ca638b3a00a73d67caddf7c
767aa72294b73ffbe525ee35fccfd5939a9cf6d1128717ac159ee9b9f9adc759
34df432fffd0dff5f4a974f12dd75d405816892e113100f34ed1b3bac7358ffe
fd21ad1a514c00f3cdadb7b6cb1a0414ae3ba4ff3a822a6a1d44857fd65bb998
SH256 hash:
e737eed2599a2322f6b51992e3e88b5cf35a4d04d0969f0e95b550dfbaf4fce4
MD5 hash:
e87d6f235d8d7e11cca3e93449f0d4cf
SHA1 hash:
f2f46f13afae428fba8d3ed9105f125f6a55403c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/74ec274e-a32e-4e0a-94f2-ebb87bb5779f/
SH256 hash:
cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08
MD5 hash:
d1d5c3e8fdf8df59741c797c0c983a0a
SHA1 hash:
2bf0ddedb2e3b7f6dca08d3b9d73ffc93c8e8ffd
Link:
https://www.unpac.me/results/74ec274e-a32e-4e0a-94f2-ebb87bb5779f/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cece3161c3a7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cece3161c3a7ca97caaa49e774c6811e1f378cdbfe9fb37e17f953da7f8ebd08

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV4
Create hunting rule
Author:kevoreilly
Description:AgentTesla Payload
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_AgentTesla_a2d69e48
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments