MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a4c86380c4daae9d19f94d2c222a4d6c2b9facadc16799e1a6686785462ccf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a4c86380c4daae9d19f94d2c222a4d6c2b9facadc16799e1a6686785462ccf0
SHA3-384 hash: fc61867826f6eff9d4ab0b8ec0e745ab6ebd7a4955f2d8e6afae3d9e277cf6f6a70bf1e5dd7939dc3af5a8d7b36c2b64
SHA1 hash: 30299cd3bd9401139d9be7e5b4d3158f5205f4a8
MD5 hash: b4c2a8d09a2fd276f6cf8d6f87d4e8e8
humanhash: skylark-nevada-iowa-mexico
File name:Pending_Invoices.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:746'496 bytes
First seen:2021-05-03 16:54:15 UTC
Last seen:2021-05-08 08:40:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:vwElO0dkoMcFL76Hur2n3gOTLX0fF4A6Nj3LMKQh64GCLiM0:vwz0yoMw7OjwOTLX0fh6NjYKVhRx
Threatray 4'440 similar samples on MalwareBazaar
TLSH DFF4233A23F58719D92F57752C75411613F0F202EA67E71E2E8A607A1F33B92C36076A
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.624-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3a4c86380c4daae9d19f94d2c222a4d6c2b9facadc16799e1a6686785462ccf0/
Threat name:
ByteCode-MSIL.Trojan.Agentesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-03 16:55:10 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjgimoamjwvotum7stjmeive23blt6wk3qlhthq2m2dhqvdcztya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3383218b916baf1a46989c4f253b29eb81e97ac763ab71615c81d85a18495f34
AgentTesla
3592da59898af133a4333cec930aad11b3a69599fdbba0de484a8c7a17aa3a43
AgentTesla
3aaa7c7c8d2fd8bba13c2a6a51dc70ec8e95cb1af76d474454b19d45ad414f4d
AgentTesla
56f803925d37e489e72c9e3a7bf128d46fd29b62f858961b2f644edf09530602
AgentTesla
6a200889617096cf84bb9fb624de6a412d056f23fa6fafb30cba99c61d846094
AgentTesla
7c3d54c847083ffc958bb52818010560aed26dc24a67f6ada0cd5da75136e245
AgentTesla
800b5262942a440b66f13082843cd7625828ddefea6f013274a5d28bfe0b8494
AgentTesla
8b5c7409878b294522e56f83a1e3a3485127756772f37dbc120bf8aa61030a0d
AgentTesla
be35f7a63f502853d1d202c0a58774460422759f71789cbf5240265aa603fef3
AgentTesla
ed5b35389cdc15f792ffef0bac637b0758a566d59945429d6e7e56965bd26b31
AgentTesla
+ 4'430 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210503-ct4988mkra/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
bdf79e57b5574f9bafb56f6d0592f5ee429df7eb0ad536fbdb4f2956aae36f87
MD5 hash:
826b29e2a141b055a5491c9d7dc6eea7
SHA1 hash:
af4201362b8603bf7e4b6e2ead1cfb610dd7c0a9
Link:
https://www.unpac.me/results/541f0626-8715-49b1-8a95-6d2856c73949/
SH256 hash:
3a4c86380c4daae9d19f94d2c222a4d6c2b9facadc16799e1a6686785462ccf0
MD5 hash:
b4c2a8d09a2fd276f6cf8d6f87d4e8e8
SHA1 hash:
30299cd3bd9401139d9be7e5b4d3158f5205f4a8
Link:
https://www.unpac.me/results/541f0626-8715-49b1-8a95-6d2856c73949/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a4c86380c4daae9d19f94d2c222a4d6c2b9facadc16799e1a6686785462ccf0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments