MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3884b4ec8f2a3aed1bc20d45c40afb3374e2f80c155f21c8e1a6e5ac533a47c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3884b4ec8f2a3aed1bc20d45c40afb3374e2f80c155f21c8e1a6e5ac533a47c7
SHA3-384 hash: 3608498e0991fde8c2cd13f6ceaf856842fdfc114804a23f80409817121fc8686c4fa8f385b314cf402d28486ffb8901
SHA1 hash: cd1b7ae164842c43e0cddceff354ddfb0db98ba2
MD5 hash: 113854094bb57aa7a3a164a8ed7cb758
humanhash: music-nebraska-september-uniform
File name:3884b4ec8f2a3aed1bc20d45c40afb3374e2f80c155f21c8e1a6e5ac533a47c7
Download: download sample
Signature AgentTesla
Create hunting rule
File size:336'560 bytes
First seen:2022-08-04 09:30:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:gORRoRG3dXjqFQHXNaEG1aFh52XkadSpAwhe5sX40gPOTL:gORCcdzqFYB+aFc/UpA4eGX4WTL
Threatray 20'597 similar samples on MalwareBazaar
TLSH T1FD649D9BBA4CB78ECA0ACEB1B9B44D305610AF7317168602F4C7FE7D457D54EAA401E2
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 6ccccc9cc4d8e8f4 (41 x Formbook, 34 x AgentTesla, 3 x AveMariaRAT)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
3884b4ec8f2a3aed1bc20d45c40afb3374e2f80c155f21c8e1a6e5ac533a47c7
Verdict:
Malicious activity
Analysis date:
2022-08-04 09:30:25 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/9dc4c573-0677-4430-967c-64ecc6cb2be3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/296414/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Sending an HTTP GET request
Creating a window
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated overlay packed
Link:
https://www.filescan.io/uploads/62eb924ebcf76fcb6ce3aab7/reports/cee94994-1bbc-4b24-9c76-d390f7986c68/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f4d3b408-c7d0-4b7d-b720-3604e1996e1f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1046156
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 678648 Sample: rgvtCFNUvb Startdate: 04/08/2022 Architecture: WINDOWS Score: 100 24 Malicious sample detected (through community Yara rule) 2->24 26 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 4 other signatures 2->30 6 rgvtCFNUvb.exe 1 2->6         started        process3 file4 16 C:\Users\user\AppData\...\rgvtCFNUvb.exe.log, ASCII 6->16 dropped 32 Writes to foreign memory regions 6->32 34 Allocates memory in foreign processes 6->34 36 Injects a PE file into a foreign processes 6->36 10 cvtres.exe 6 6->10         started        14 cvtres.exe 6->14         started        signatures5 process6 dnsIp7 18 mail.tycautomotriz.cl 10->18 20 tycautomotriz.cl 131.72.236.163, 49757, 49760, 587 GONZALEZULLOAJUANCARLOSCL Chile 10->20 22 au.c-0001.c-msedge.net 10->22 38 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->38 40 Tries to steal Mail credentials (via file / registry access) 10->40 42 Tries to harvest and steal ftp login credentials 10->42 44 Tries to harvest and steal browser information (history, passwords, etc) 10->44 46 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->46 48 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->48 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3884b4ec8f2a3aed1bc20d45c40afb3374e2f80c155f21c8e1a6e5ac533a47c7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-07-13 07:40:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hcclj3epfi5o2g6cbvc4icx3gn2of6amcvpsdshbu3s2yuz2i7dq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3fe9849800694c779192d7ce7ef3ced4a0175ab96d804f3ad42d4b88413fbc5d
AgentTesla
57a45cc2512f42b829e6d52fd76edb3f1e9d6b624b8a11ca767186a82d407bc0
AgentTesla
5d44448d9368f5ec2b3594446bca10ae98f173176a4e9a55fd239c3c6d9c6edd
AgentTesla
60207148ad8dc1c3de32439255a241321d4f3da64c82990e871edf28e3eca804
AgentTesla
74973603dac46cc748a587ef2de2522fa3e5f08862126e916520969f3f444ff8
AgentTesla
91db81cd38b9f713767e35c4012057b99734e8e0e889af77935c6a0b47eedcbb
AgentTesla
cffe911cab47a620844da9e4e5dd658ac6d47b6771385721015a73e6b1ae2bb0
AgentTesla
f3c22af4dadc884ac3182ba7c79013082e9a835c19d23d7654aa493f56eb3852
AgentTesla
+ 20'587 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220804-lg2hwsdcd9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Unpacked files
SH256 hash:
225be20986e2bf3fd858cb4838648967993a249816d8e53f8c7799581aef1fb8
MD5 hash:
9500e22b3be55b4f4a49570c50820abe
SHA1 hash:
ed1efe17f3fa67319dcba5dbe5025bc7ab734cf1
Link:
https://www.unpac.me/results/11ca44df-24f6-4bd5-a41d-154da2090bb2/
SH256 hash:
9636ad77d30d703682b7781165316b53de3fbfdd7851984fb0bfc43b98193d90
MD5 hash:
4d2fa1dbb82dd18069450cfbdf50968d
SHA1 hash:
0babd23ab6774d1e801499e9f5d4f24e949d7e80
Link:
https://www.unpac.me/results/11ca44df-24f6-4bd5-a41d-154da2090bb2/
SH256 hash:
3884b4ec8f2a3aed1bc20d45c40afb3374e2f80c155f21c8e1a6e5ac533a47c7
MD5 hash:
113854094bb57aa7a3a164a8ed7cb758
SHA1 hash:
cd1b7ae164842c43e0cddceff354ddfb0db98ba2
Link:
https://www.unpac.me/results/11ca44df-24f6-4bd5-a41d-154da2090bb2/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3884b4ec8f2a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/3884b4ec8f2a3aed1bc20d45c40afb3374e2f80c155f21c8e1a6e5ac533a47c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/296414/

Comments