MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33617217fe9bf49efecde14a18fe04ebfe6453361f6e69958f7f0c2fe6462b73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33617217fe9bf49efecde14a18fe04ebfe6453361f6e69958f7f0c2fe6462b73
SHA3-384 hash: f1e9f15370d5504ff2227d4005c0c0a1932d676b0de5ed6435e343cd32d0aa2c8615f61c17d5ca6424618fc3a76fc9c7
SHA1 hash: b90d5d13406f55b63d049c7d9ac37d3c457cba83
MD5 hash: 59478ffe0c008462e643f4e80d55c8ee
humanhash: east-monkey-king-comet
File name:Transfer_1032109387.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:281'414 bytes
First seen:2021-03-10 12:26:41 UTC
Last seen:2021-03-10 13:45:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:LPKyLL3BT9ryfSfWqLu5FFJLBKSsyneTjL0YwrlTh:GsBT9mfEsPsyeXLtwf
Threatray 3'142 similar samples on MalwareBazaar
TLSH 4D54121315C1B127F683AAB15C5B9137E637C292A482B8538B707F972AB5B437B1B343
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Transfer_1032109387.exe
Verdict:
Malicious activity
Analysis date:
2021-03-10 12:30:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6887f8da-b8f3-48cf-99a3-6aa0e854f1ed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/123614/
Detection(s):
SecuriteInfo.com.Gen.Variant.Zusy.370710.17890.1424.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Unauthorized injection to a recently created process
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/634338
Signature
.NET source code contains very large array initializations
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 12:27:09 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gnqxef76tp2j57wn4ffbr7qe5p7giuzwd5xgtfmpp4gc7zsgfnzq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
013066864283e4be87e7bd39b6e75ef40e98014377d520ffd213a8de2d59923f
AgentTesla
10af1d92dad836fcb80093f9715d0515f5de7ead530b401f7c537afa08ab3117
AgentTesla
168d180de146160d0ba93335e36e00d62029ea13f0a41ace68a76e8a2b547ac3
AgentTesla
2ff867e475abe496c04c7a4193d8cdb9d5687846fd3d61bbb439aaab0d9f7496
AgentTesla
9cc817f0205da4bde1d938e1817aa98fe4f4a5dcbcaffbe8b45041e24c105aa0
AgentTesla
a6689fdbaa2f96dc048f720cf57a1f6a80ce52b476a568a22a5bf0883a7386d4
AgentTesla
d2fdd26effc669ec89f294c59ba3bd55a698c75fe89404655b6b010ef76f2237
AgentTesla
ead0f6ef88c149f4318129ed6e3ef5fb30bd2ab03afef3625ca08d1b2f6f180e
AgentTesla
f7af12b666ffa2eb7f5c8a4bdf258b4b47138f8fe21f7f11271581caa891918d
AgentTesla
fc6ea0c4fe6733f5e28ff0476efbacb55d2f8ce35e4313988454f77c819afb56
AgentTesla
+ 3'132 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210310-p8yjcm73hn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
33617217fe9bf49efecde14a18fe04ebfe6453361f6e69958f7f0c2fe6462b73
MD5 hash:
59478ffe0c008462e643f4e80d55c8ee
SHA1 hash:
b90d5d13406f55b63d049c7d9ac37d3c457cba83
Link:
https://www.unpac.me/results/6c2c4d38-6c84-4802-a958-2b719566ffb6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/33617217fe9bf49efecde14a18fe04ebfe6453361f6e69958f7f0c2fe6462b73

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 33617217fe9bf49efecde14a18fe04ebfe6453361f6e69958f7f0c2fe6462b73

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/123614/

Comments