MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3846d47dca1f1fed9d5fd5630118cd3b7282938895d25afc3b528cf0cfc1ac4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3846d47dca1f1fed9d5fd5630118cd3b7282938895d25afc3b528cf0cfc1ac4a
SHA3-384 hash: b041a7df9c2b2ae9b09ee2e4632838c358fe1945fccacaf83821d67e83cfefcddf490551270c276ce2591463715c7e60
SHA1 hash: 8a4f1f2de2a11e2c16822c9d2eee65a20bfb4b62
MD5 hash: 423affaebce810ad9b7e86f6108e7896
humanhash: virginia-nine-artist-yellow
File name:Ref 4359-0201-106.034.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:709'632 bytes
First seen:2021-07-20 06:11:16 UTC
Last seen:2023-04-05 13:43:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:8IqhHa0aTYCN/7ifOfTGR6EktIkH5JdlDwY+BCe4uv6HiCrBnfJ:7Sa0CNTi2fTGR6d2g5xtxJOYrB
Threatray 7'044 similar samples on MalwareBazaar
TLSH T1F0E4BE38645559AFC622E533C268EB00FEF359927232CC0A039BE6871F0B553699EF5D
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
6
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ref 4359-0201-106.034.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-20 06:14:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5508f27d-e24c-4178-b713-1174a5df5a6b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172702/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Agensla.ic.12947.3061.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/25729d9c-771d-4a63-95e5-7ec071128413
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/818698
Signature
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 451109 Sample: Ref 4359-0201-106.034.exe Startdate: 20/07/2021 Architecture: WINDOWS Score: 100 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected AgentTesla 2->27 29 4 other signatures 2->29 7 Ref 4359-0201-106.034.exe 3 2->7         started        process3 file4 21 C:\Users\...\Ref 4359-0201-106.034.exe.log, ASCII 7->21 dropped 31 Writes to foreign memory regions 7->31 33 Allocates memory in foreign processes 7->33 35 Injects a PE file into a foreign processes 7->35 11 RegSvcs.exe 2 7->11         started        13 RegSvcs.exe 7->13         started        15 RegSvcs.exe 7->15         started        17 2 other processes 7->17 signatures5 process6 process7 19 dw20.exe 22 6 11->19         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3846d47dca1f1fed9d5fd5630118cd3b7282938895d25afc3b528cf0cfc1ac4a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-20 01:56:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hbdni7okd4p63hk72vrqcggnhnzife4isxjfv7b3kkgpbt6bvrfa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
45138eb7e63567beff1b03dec29501bd7c0d9e0e47bad4bdcaa27138e3f0005a
AgentTesla
510768bfa392b714c73dda02fa27430c67036bfb33240b27f405a39931069ed0
AgentTesla
535fc42d2f30f39926f25da2b11211c6076ce166c1389df0419db06a3432b852
AgentTesla
562d9a4326e09ecb7f988355d1d56c39d025f292c3d3e8a5e319a3ff2c44866d
AgentTesla
669fa8cb14463fe4d7e152c852686a8d27bfa932e8a51e8064fc26da0ef040b9
AgentTesla
6eb0affd63b0d85be603948881fc6b643103e96e3f68acf1350969e8d09cc7e1
AgentTesla
93cca2ba4ea093c17f9ec9f3997efa43be301489f8f3a99465e6017dd74aa7a0
AgentTesla
9538802ba4375e4207896722f9062ed583dfa523601f5473e000047c4faec144
AgentTesla
b7ca7cb881d15414b022a7c568bfaf861a0be5c404fa800cd6549dc5819c6d0a
AgentTesla
f0a3247dd909ae3c546e45891109b28ea158c0be38913a658b065e980f48a991
AgentTesla
+ 7'034 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210720-j9g9kcqaln/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/d8255d92-7454-470e-bfe3-a56a541a45ae/
SH256 hash:
5af135704dbe793577d575545501fb97ec8e232fe47a7e1649baa7d60df8d3ac
MD5 hash:
174ecbd0846a676d141a8ffa67363bf9
SHA1 hash:
b2785e4bbef59363d8e1626d068d82df8b88cf05
Link:
https://www.unpac.me/results/d8255d92-7454-470e-bfe3-a56a541a45ae/
SH256 hash:
6b75242920cda57de4925fc79b7e04072843a80fec0929411abc5419a2b0f20f
MD5 hash:
8cf519a208c8d401c5810b58eb14da01
SHA1 hash:
4747dda5f871fb6e97a4518323bf81dc69349ff5
Link:
https://www.unpac.me/results/d8255d92-7454-470e-bfe3-a56a541a45ae/
SH256 hash:
3846d47dca1f1fed9d5fd5630118cd3b7282938895d25afc3b528cf0cfc1ac4a
MD5 hash:
423affaebce810ad9b7e86f6108e7896
SHA1 hash:
8a4f1f2de2a11e2c16822c9d2eee65a20bfb4b62
Link:
https://www.unpac.me/results/d8255d92-7454-470e-bfe3-a56a541a45ae/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/3846d47dca1f1fed9d5fd5630118cd3b7282938895d25afc3b528cf0cfc1ac4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 39ef587594d01d253cc20a47dc53666e4dca55392d042d59d853a4542df030f5

AgentTesla

Executable exe 3846d47dca1f1fed9d5fd5630118cd3b7282938895d25afc3b528cf0cfc1ac4a

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 39ef587594d01d253cc20a47dc53666e4dca55392d042d59d853a4542df030f5
Cape
Cape
https://www.capesandbox.com/analysis/172702/

Comments