MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03
SHA3-384 hash: bc20ba6820c07b20704131d9fe33f067f3cb0d6db7dd26df79db73d99c0fe75c8dd6faf6cfd563ccfea5aebb4a710225
SHA1 hash: fa15b01076e5d395638102b0b77624092cf20c4b
MD5 hash: bb8847dedcaab8b7d34163a2829b6930
humanhash: california-asparagus-low-spring
File name:PI160256.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:715'776 bytes
First seen:2023-05-22 13:24:30 UTC
Last seen:2023-06-05 10:36:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:IvV+s1bSQT6tjjdB4UmuubNQxq1W14QPCxV9wcoSXT5M/tF46:ItWnubmxqs1axVGchDit
Threatray 1'606 similar samples on MalwareBazaar
TLSH T161E48B5633B57621F47D73FD00196388CB38B44A2122E22A1F963AD546E37EB770A6D3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
11
# of downloads :
282
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PI160256.exe
Verdict:
Malicious activity
Analysis date:
2023-05-22 13:25:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6bef2dcc-1151-4e92-98c1-786a81d91a25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2040.9651.24407.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/646b6d2f94868b4175712a76/reports/7919580b-b242-4d77-ab68-e3ac1c04099f/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8ba65426-256b-4e41-b605-ade6b3bdaf71
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1239779
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-05-22 08:02:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
15 of 24 (62.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hquemrqzihv3tacqslay2il2lz4lorqz5axzxmq3fqi5lgluz4bq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
03c2c605e315b7589bd9f386579027ad31d4014d5dc3d48ca9a446a5e53a3afc
AgentTesla
320c4584c3d392006ef443e5743123a45909fbae309c7561ced8fac11e11e5d3
AgentTesla
67aa6dd3cfc208be2bf9bc11b9e2ab4dd59f594653f4f073c8b96b5f5872c286
AgentTesla
76a59267c8c6b0e6878ad01204e5971c46726bcdb41bd74818b038baa597e027
AgentTesla
76e99b721f51b1f6c0f4578362c0cd3088338b1c4ea42a32380b558c908eb31c
AgentTesla
93a9ea827dd8635158be7b107a40feeb50a52566698915f0c499a5f50c157200
AgentTesla
9bfcddc5558b99ca104647f9f65f6eeb585d7eada6a786e841ff71d9a7a4c682
AgentTesla
9d2fe317d804de453747ca99b16054d206513ad14a7f4ce8a2507db982fcb533
AgentTesla
e523dd1e51303c2be9fe5cccef1960524a5b6de9bb2aeab9e4e4cfc94c86db32
AgentTesla
f071e06b294ad94e6c83f6b35a9700b8cb3df225e76096730a38567de1c50450
AgentTesla
+ 1'596 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230522-qnysssgf57/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5814058627:AAFjPgERfyp3AZJXAfISMezajcw2VR_A_9U/
Unpacked files
SH256 hash:
4c7ce432433fc3a8b0a33d558e0041d3f1c222224c5e61f33104d990a534c7a4
MD5 hash:
e8d756b4e2de5a67446e0b1b80e1bb99
SHA1 hash:
b664448f87ac044a16706d35e5d76538ba79508a
Link:
https://www.unpac.me/results/91caeafc-412a-464a-a2a7-2f5b22f8c898/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/91caeafc-412a-464a-a2a7-2f5b22f8c898/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
c7014a2378d39c8b6f0e2a06f5d08a1b860e533d529030c63bffb97bd6106d53
MD5 hash:
7c132e24d2a42255016f6899aec4cd7b
SHA1 hash:
791544990816c3081cb062e9e64e5c14792426e4
Link:
https://www.unpac.me/results/91caeafc-412a-464a-a2a7-2f5b22f8c898/
SH256 hash:
c96fb3dc5a9431689ae0743d6902a32e7b8db4da6acd8dd483135fa7ee3a249e
MD5 hash:
4b18a2000d83c3f77249bfb4abdb5f6c
SHA1 hash:
67dec089a906f60048e7dd00278bcc987a437270
Link:
https://www.unpac.me/results/91caeafc-412a-464a-a2a7-2f5b22f8c898/
SH256 hash:
b9580b71d77516b2c51fa4887ff049e1ee8261d3bb4a45cf0d7f8ff45492b491
MD5 hash:
d21eb64badbd0f004774eb771ded295a
SHA1 hash:
494af84caba0b679040d36e14fe1d12f448884f8
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/91caeafc-412a-464a-a2a7-2f5b22f8c898/
Parent samples :
ecc62761886dac7775e9dcf2c323e300a5c694e1322496a1ad66808eb7dfd940
7c32af309a2521511d759a08cdc7cefc647e94cbdd590e7f7ef8ef24fa8b539a
12dd7993470fb8771929bc1fa70876866bb29f8a4f43d5c79dc8d643501bd3a0
9c12f011c55fb007079146d47ac150500585108217d74e4209f234006d91590a
997fb68f57771d4e6d2c607afae34ddc7b06daa6f34be448e5f7d67e78b183bf
1680422c807dbbb8686d36461be752fbb2ad0d75d48711de16f85eb72d977203
3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03
b58289009391f4997135e60b89655880cc54e3e7ebc90e6056401be2b798a3ee
c7057a9a9f625dc07c2d893859df339831330e74a0cfb6b7677bf973f0af279f
734da354d0b8c982d436b43e4f8e105382af3d08def6114dfa685d1230bf64dc
1af9751a544e54a90c1b18ce2fb731d3f9b2e53e7143f9904622706109949abf
ede092c0e91728ee489218bf3b0467e4ae95891b425aae840bb918d66fbc278c
93b2e11e63c3e38bd7d2fc22514d2ae970e35ee23bd9fd829a75d25df3794dd8
SH256 hash:
3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03
MD5 hash:
bb8847dedcaab8b7d34163a2829b6930
SHA1 hash:
fa15b01076e5d395638102b0b77624092cf20c4b
Link:
https://www.unpac.me/results/91caeafc-412a-464a-a2a7-2f5b22f8c898/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3c2846461941/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9db5ca2e4ac477979eb838d5a5233104bd02a5f1f381710ff6784bb7932e56a9

AgentTesla

Executable exe 3c2846461941ebb9805092c18d217a5e78b74619e82f9bb21b2c11d59974cf03

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 9db5ca2e4ac477979eb838d5a5233104bd02a5f1f381710ff6784bb7932e56a9
  
Dropped by
MD5 d9502ec245a991f146a8870b6dbc441d
  
Dropped by
SHA256 40e3bbb6750106c0c6b509f24272314310b9c6ad3a50ffa64be2a2cd0fccd330
  
Dropped by
MD5 4060c14423d751f87bcbe88d2e08aa30
  
Dropped by
SHA256 f9273d2a44428027824ec2b6d9162b0dcec265392efdaa2d0065ff1293c85445
  
Dropped by
MD5 265dc35077f45155323222dc0d0f2daf

Comments