MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0
SHA3-384 hash: 4c74e76dc0680241fdc3681fdfd10089a9d9b40580d443681fd7f01b73ad45f9218432be7e93ea3af14b504f03fe0ab1
SHA1 hash: f63e4276564b74de90d6a1fbeddd3044c53e68ca
MD5 hash: 8c20bb030415e9f7f3ac5f3e5c5fbed8
humanhash: zulu-cola-march-low
File name:νέα παραγγελία.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:573'952 bytes
First seen:2025-02-14 02:10:36 UTC
Last seen:2025-02-14 02:41:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger)
ssdeep 12288:QquErHF6xC9D6DmR1J98w4oknqOOCyQfpOrRTwsMaN0aVEe/R:hrl6kD68JmlotQfwNEK
TLSH T194C413845BE1D853C6989376853E8CA05A663D32DE8DB7AD8748FA0FFC31307E44A61D
TrID 35.7% (.EXE) UPX compressed Win32 Executable (27066/9/6)
35.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter BastianHein
Tags:AgentTesla exe UPX

Intelligence

File Origin
# of uploads :
2
# of downloads :
525
Origin country :
CL CL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
d7db9d185bcdce66e114db7385e126f2e50560b0fbb590efdbd887237732dc88
Verdict:
Malicious activity
Analysis date:
2025-02-14 01:24:24 UTC
Tags:
arch-exec evasion stealer agenttesla
Link:
https://app.any.run/tasks/5b434f98-04af-4463-a145-badbcce58985

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.AutoIt.1592.3945.15312.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67aea63da0fd713c335ac667
Tags:
nymeria autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
AIT:Trojan.Nymeria.6830;AIT:Trojan.Nymeria
Link:
https://www.hybrid-analysis.com/sample/dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0275e582-0fd1-4cf4-a8a7-10d22322bca1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1614756
Signature
Binary is likely a compiled AutoIt script file
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-02-13 08:50:36 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3qwvlxtokmlk5nzlek7uexu6vobk3o2ier7y7c5y5dsgitwbsgya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
unknown_loader_036
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/250214-cmbpzszkax/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Looks up external IP address via web service
Downloads MZ/PE file
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
trojan external_ip_lookup
YARA:
SUSP_Imphash_Mar23_3
Link:
https://app.threat.zone/submission/b1040f8f-9776-400c-bd22-854c515af718
Unpacked files
SH256 hash:
dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0
MD5 hash:
8c20bb030415e9f7f3ac5f3e5c5fbed8
SHA1 hash:
f63e4276564b74de90d6a1fbeddd3044c53e68ca
Link:
https://www.unpac.me/results/e4adf140-ec0d-44e7-aa75-48f1302e1f1c/
SH256 hash:
ce0b9b24b5c1d33c48d8eb08ff59cc8b7d529a1366219f60ae80c1eafb3801ad
MD5 hash:
e1907af858a5658c6f4a29699dd79731
SHA1 hash:
c5e21529b42210082bb7e39b57633116a63600ba
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/e4adf140-ec0d-44e7-aa75-48f1302e1f1c/
Parent samples :
dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0
ce0b9b24b5c1d33c48d8eb08ff59cc8b7d529a1366219f60ae80c1eafb3801ad
SH256 hash:
d11f7bb1201fa8666a87e1dd5564bef288c868f9cd3d4d1ab18c381ca6ad3a78
MD5 hash:
1714efb0f74f6155a248a933e91357ad
SHA1 hash:
7a8ede062f25a6b0f81e9a496e633f33f2832b81
Detections:
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/e4adf140-ec0d-44e7-aa75-48f1302e1f1c/
Parent samples :
11ee801f67fc5108cb0e36b3a91405b2a83e86d8de457225cd14292eb46e19e7
2423cbba54e73aee0fcc5914484f01f2f11684cdde5a3a07681d0d3fed59aa36
787fad37efb7d8a1da898dc229a32211a3de0145815b7f0c46a7d5f74046fa35
30d91ef269ca652f181ba1985cf2cf8a5790305927c6887e0c298c38ae87afcf
c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0
4fb5281d2ac2e31416f64aa0ddcece35ac2ebea9fbe503dfdc8036a1289403ca
da66e29c9666cf148014ef6794b6f02ca30d3e08188c57487d21e2e05d260b68
c254f01dadf304302e5f3398c2d27d3f68f20119e35e9774037ada01dce922ea
d11f7bb1201fa8666a87e1dd5564bef288c868f9cd3d4d1ab18c381ca6ad3a78
adb52449dd91168825ddfbfc214838688e63eb9d2d66191b2d99fd3c63ab2592
576a8ef62a3aa573eeb32128100bba673c0c967abf51ece921781608e13fbbd0
b9c9fd099abaad643515c86e4c5db4e6f62d008fb4e7b9b2cd407f050dd33119
8310d68a7f689fa70a20da444f64e6694c5513be2839a2fc88aac159d064a38a
2cb274eea982562d847d3c6674f6a07584c2f66cb203b9fd4fd710074357ba1e
2fdf4ec52e749c2048c0b85fba9cf8df15eafb94453d758bdca13a65140185fd
23699ad43e832923b83bc820adb52b17eb5bee5720129720d51a386fe9d59cac
66d03b788fb30b48ae88976c7f558f4da002665d2c493914addf9449126b9daa
15c74162d5e448d5691900c39f7c8c9939204bcff280eb316fdd6802a3a28f3a
7dd88bb379949c90207a5d476d7318ba98ccb6cb7853409c6d323febd28d318d
4f338449a4fa2e63dbc9aac4d96e4a4d47aacc96ea5fe62ef55301a464be0dcf
5420f805940014cf9e51372725194209e75017aaa65c73673ceab6751784fe1d
309c72a0cfc3bd2a848c978921abe215da76dd3aa38f3221d28cb6524c35ba85
f11a80123a901473bc7a5dabdd51847e6adbda96280dec8442fd2ef96cce42af
70c57e0ebfbae88ab7a75a250ae1618de974bff18b1c91f9800cdd399bd59561
721490f6523a38a63d64f8d266f32be5cd9f4140f1bb2577fa7b579b105ac37d
af97c20ead714a7ffc48993c9655ea0fb2264f927fd5d66403d22877ef197495
dc2d55de6e5316aeb72b22bf425e9eab82adbb48247f8f8bb8e8e4644ec191b0
ce0b9b24b5c1d33c48d8eb08ff59cc8b7d529a1366219f60ae80c1eafb3801ad
1e8ed2a1de9da3023bb2804b5e7baacedb1056bf93710f0e1edc1697c5f8f38a
62d2a947027c152346af07520fc7e0596c38460e19548a4ca1cb4f897b50290e
98b15e40059c4708f31e44f14f547f4533c32c117efb71c7cef9bc3aca253c72
70786a83bfa0b84514ea47447505e87fe3a2daa1357f1ab76b864039d33c0fe8
66d7d602350b27bd25ca73436b6b7598c65e5022cc8062eb5c87dc604ab97952
f36ccfca37c4131f7407665c75597630bb1df079a055dba2b8ee3321bcdbaa00
2d096b77a85732091954e941e842e3518cda30e2ae75c64e68f893bb5bd14b46
b29185ff9cbbe7ce8b9016966964c905df26b69f97ec6c7adb42df0dd3b31fc5
19bc958cc02a866392afaac8e9d5d5887ee5361b16908ace45d64dd7e4546350
4860d655679f0a13c8710e4f4f273421ea3ac90c5ffc1f3a7d61d3a4a6b46ae9
572a8143626c3ba4a47ab7ddb26146c0de475ab3a0f405193305348cbc02603d
86a32cb0fb642641f2b04987043472edaa31b283c437a64c9e0fb7a549ac10a5
6f853fefc8f4fb4e4b5985f40f6180278ca10b8904c887f93c86b32b7b77b844
bee44d25e7798f6d4364e452633610b0656d76bc5c1577eced9a40554f53a04a
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dc2d55de6e53/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV2
Create hunting rule
Author:ditekshen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Imphash_Mar23_3
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:Windows_Generic_Threat_9f4a80b2
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetUseConnectionW

Comments