MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854
SHA3-384 hash: 89b050c469b76964686edf784034f2a2a5532ed6bc9d37463d59c362ed4df910455e99bc69838109e49adf97176fdc67
SHA1 hash: 2cef82a597954138a4e998c3e742ea48da6422f6
MD5 hash: 54f17a2e2c26de6e47bcd7c38f7fa185
humanhash: music-social-pip-leopard
File name:00_datos de la transacción rechazada y número de cuenta incorrecto.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:700'416 bytes
First seen:2024-08-29 05:57:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 21371b611d91188d602926b15db6bd48 (60 x Formbook, 23 x AgentTesla, 20 x RemcosRAT)
ssdeep 12288:6sHzOUNUSB/o5LsI1uwajJ5yvv1l2qqrSW1DangcSvMs22JF:tiUmSB/o5d1ubcvaregcSvMsbF
Threatray 3'168 similar samples on MalwareBazaar
TLSH T169E4231555C1D869E25233F4C47ACEB146A07D308E957B7A8380E7AEAC32386DD13B6F
TrID 39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6)
38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
7.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
505
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
00_datos de la transacción rechazada y número de cuenta incorrecto.exe
Verdict:
Malicious activity
Analysis date:
2024-08-29 06:15:58 UTC
Tags:
evasion stealer ftp exfiltration agenttesla
Link:
https://app.any.run/tasks/853453d9-8d29-434b-abf8-6f2781f80056

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Win32.AgentTesla.13683.23123.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d00df0f1a57bfb7091462f
Tags:
Autoit
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8cb57a0c-adc9-4fdb-b59b-856d541b7225
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1500991
Signature
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Found API chain indicative of sandbox detection
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2024-08-27 21:39:10 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=46q7fj32lwfcrsrwiikijo2wb4zuwq4zv2j6xw5hdfegpchn3bka._file
Verdict:
malicious
Similar samples:
3ed356b88af2907fcad812a2ca7fb093f31d6f14e5e54889215a60d913627f8a
AgentTesla
719b90e90ec80dc97228c3bf8116c9a45fd3636a93e4d0c6917fb8de7f719ef8
AgentTesla
759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef
AgentTesla
7946865787ec14985dbeb9fd9b08f426a2aabe834e5110b9f22f3c6dcede79b2
AgentTesla
9afa3f639b13409cc496e135540e16f546b1eb447bce1a007ad34a04c5b057a7
AgentTesla
b570b4c535ada09737a77902127a03fe3b01b108651325538fab2911e7d8ef83
AgentTesla
+ 3'158 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla credential_access discovery keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/240829-gn6nzayfjm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Looks up external IP address via web service
UPX packed file
Credentials from Password Stores: Credentials from Web Browsers
AgentTesla
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d405b1f9-7194-4557-93be-26ece298f0f9
Unpacked files
SH256 hash:
213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe
MD5 hash:
6001b9d313616cf68a9d9d6bc7492015
SHA1 hash:
6aec558ebca79b3a6a0b4aaf3c9daa18a1fe7cf5
Detections:
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/b7c4b898-ede7-4cc6-b3d8-671a20f17edc/
Parent samples :
c9be1ff9d80d934774556669459ad3242500a745531ba25f7c874f32f318cdd1
f08afadff8298941a488a237df4deb8f94f13bf274411548f386d2828f4df636
51f24503d32c9e10a2e7afe027d438380d007cd1566e5399cc52b039cacdb2ea
bc3e963b1e6f8e375e6814f653eeb463d2bf8e47b867cf16ca9964a5e0d43804
ce89a0a88051c50bf0be5ab41e5f2d478b5f3eac141b37a9743cab99423656ce
c8634453c065450c28be1e99497aea78c294693e0c05e63a6d6fb83cc621f190
71f5ee1f2818fe32525676a403776d620101dfe96ae3873a3e325016ff136002
48d245036c30302a860c3a616e29cb0e633fca178bb363d01007432d3c571713
64786f8c089130fa81ba1970f8bcdee574964bb7653f5aca740a38fc6eef74e2
aa64d8ae63a060c83638ad8a45e5a4e445a53845f4f22fe808f1828663629731
7f8bb8901ac2cd42c191b43dc859d256628e6419a418feed9bf44210b1e4c207
213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe
e46caf67893b64806cdcea05d9b42e52fa65f239cc12782ab31766beac12eb37
2fdefe874a54576e8a4f4566b328120a7163a47b1000af443683af41698b6b2a
717b2beba07031c0671b2cb794d01b5f365c58ab156c0929a05d1cc0f3f4b17e
274013bc54c33bfd77473b8a92016b247b6832a1d26a9f412596cc9189775efe
2ddbd1c388f18a820122163f5c250dbfac936824267487cf0c81fb3b01185b4a
cdd388be236deee1d6613f35f895fa3adc65cd680e560faf0a174b0004c93995
967e07ed35fc477b00fe777c8bd4f5e7ead02d2581987bb75f6386a485799078
2b8f5dfdd98be0d5612f31c49ec4e3abdc14ab16091582f904949a1bdf476ab4
b96a282048c3221ce0180359da5cf97c55c7cfb054f7cfdde1bf5438fdb55399
d8190f8804e6bb5885f42a27307794ceae1fd1d4675b3c6a96d70c30324374bb
44cf26d4eda3a4366204a89842a433c77e44184db6bf2c00a3547288a73d4792
213255cb36f1a19a7d374ba37f98b553f2a10fa9f486e92ed2ca377d1a6dc6d7
4b76f920a96119a383e7c5df2992e9e7fe5e11ef45e1a630dbe8b3abc49abae7
3661575ad4a227bc52a9fcdb9a56ea19e0f882105300b938e9c0b634fe46d892
ebf39fb8c6da07c6f344537cb98113d3f6f34bac9097e2c195bb9073c790d1c5
14825e0e8ecc953c8ddf82dc0af6159ec59d97ea51472a3a025f0a7c2afef1ad
e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854
4eae876a9c21fadb647a6fe14c83272189ace267ebed4b320c73da14e095dec7
34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208
ff2be6f85c26c62d50364e48cc6f6209df35b82d6c4b0db31e776f84b81629a5
86c0e8c71fe53ff1ee1ac2a494c208392b9f4128f85552e69105e8fa19724f63
50eae2b11320442a2ac89762a8bac816626850ac2563312a9b421d692fdd8ac2
0eee8e3b1a6558f648e2519e494ea36b8e079bf6e0cbba55bfa9dcbfc99eac11
fc7c241bd2d7edf961b8f1af19fc80419d239c67d72a8eb0610152f1e67841d1
7c11ccc1701800c57b435767bc27bf966b88c66e0df0dd220d9f3e6bde634367
93a9b3b4455c1e8469d1e70599f1ba12d103dbf09d9bcaf079a00e0ca55aa72c
1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af
f8b68f9f0dc3d844e3ae080463b29bc9bb82a750b3ab01aed7fcab4cef1519a8
67bf2a6e18cc9f982fbafc235f75604ab53da2936365bb29dc008470ebfb7fd1
92c5d005c4454ff4be8093157b6f5d5cb11e7254fb3f979ffdddf167e464955f
78d2fb60645775efc2137c4f4dab8f737724f9936577f84fe3e3e01622e9770b
523c3e9f716ca9f2a75109f674135b55e9b25259d5d078175fb5580965426f8a
d2b275edfe93caf7e90362a513f00ffec34f1b10df49d950db008a3417045311
SH256 hash:
97ce7bdf860f11dbe6e3edc89c8260d7873ef00be37af4841c7fbbac3c024c37
MD5 hash:
0a174e4dd47311e738bf6b8cf243c9ff
SHA1 hash:
0b8e484a4d21177c14165d051dcb43935efe2c54
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/b7c4b898-ede7-4cc6-b3d8-671a20f17edc/
SH256 hash:
e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854
MD5 hash:
54f17a2e2c26de6e47bcd7c38f7fa185
SHA1 hash:
2cef82a597954138a4e998c3e742ea48da6422f6
Link:
https://www.unpac.me/results/b7c4b898-ede7-4cc6-b3d8-671a20f17edc/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e7a1f2a77a5d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7a1f2a77a5d8a28ca36421484bb560f334b4399ae93ebdba719486788edd854

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetAce
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments