MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 20

Intelligence 20 IOCs YARA 21 File information Comments

SHA256 hash:	3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f
SHA3-384 hash:	9ea211a28796b2507322c3d5688e7c1b40286891d9432e275028bd3d853c6dba854cfd90083fe36c59d13de1d1e2d8e8
SHA1 hash:	0c6d6f5cab8f21e82ced364b93aba0a21c0798a0
MD5 hash:	3c582d4727edaa1c78c7d8030aa54f36
humanhash:	pip-network-coffee-butter
File name:	HSBCswifteur.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	908'296 bytes
First seen:	2024-06-13 10:12:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'631 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:eDVQijyCK2xrOoC2HY+aOXZq/0Rv65U1Y34+RABWn7zl6Cb5iDtIBFXQzCd5ySHx:dqyC5C2HTJw0M5U1UWGlItI0zC+SR
Threatray	1'794 similar samples on MalwareBazaar
TLSH	T13715F1053B742B46FAF94BF665610114A3B0702A18BEE3195DC9B1EB5DF2F108B66F0B
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter	abuse_ch
Tags:	AgentTesla exe HSBC

Intelligence

File Origin

# of uploads :

# of downloads :

381

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f.exe

Verdict:

Malicious activity

Analysis date:

2024-06-13 10:23:45 UTC

Tags:

stealer agenttesla exfiltration smtp

Link:

https://app.any.run/tasks/38be99a6-9acb-4fb2-b8bd-556df824fa2f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.RATX-gen.3491.10245.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=666ac6adda262547655efca8win7simulatehigh_evasion

Tags:

Banker Encryption Execution Generic Network Static Gensteal Dexter

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

89%

Tags:

overlay packed vbnet

Link:

https://www.filescan.io/uploads/666ac63eea679c2da9184b22/reports/7f7d93b7-4d3b-489e-8507-87666963df87/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/482f8a61-3f8f-4df6-ba4d-ae48290cb3c3

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1456517

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2024-06-13 05:23:48 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hrpshe2ravqusas4kywivwcuxoc5jd6q4gvf2p5ctc7vmofnarpq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

473a8dd3d40e70215725190cf7769b1a7f724c99010ceacb4a9b74d53bd4737b

AgentTesla

af6694d1a51a60d7bf11ca63a9af3e749c122490ab8f620921b73f89eb1d9123

AgentTesla

cd5110082d76cfc5694f423ea462e55f1675bfbb04a4ad70ed5416a6377a97b4

AgentTesla

ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305

AgentTesla

+ 1'784 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla execution keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/240613-l84gkaybql/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Command and Scripting Interpreter: PowerShell

AgentTesla

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/0f015816-f7e5-45fe-8fac-cc907199e19b

Unpacked files

SH256 hash:

d67867ef93204c27c126a41fa778fcdbf89e34a3750014d8cc4a9394a1300d96

MD5 hash:

cfddc0c2c035e91ecc76782ff513e30a

SHA1 hash:

efd2f376cd2a3574240be6b03c563f42630a6ef7

Link:

https://www.unpac.me/results/69479671-7a7e-4af2-80b3-769d4b6230a7/

Parent samples :

82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8
804aee8eba800043c912038c55c36edeb8dd761913047e99b4a5e8d8cb8ef6c4

SH256 hash:

1feba65bd2aa62dc3cad4b386b25e5a5922cfaaa4f0c1aecff536bf10f54dc12

MD5 hash:

21ca6aa79257797cfcf81faf284a9f89

SHA1 hash:

bb55c21f04bd9a0d6fbd40f7129ec68344bd524e

Link:

https://www.unpac.me/results/69479671-7a7e-4af2-80b3-769d4b6230a7/

SH256 hash:

51bb851fe15c5b0e184b4963bde12c19f30aee9fcb1d50682f02c59a09357678

MD5 hash:

dd35195e2a3686bb209faad2799bd50d

SHA1 hash:

ab3adcb3414e114135b12e4561b4f3fa298e47b2

Link:

https://www.unpac.me/results/69479671-7a7e-4af2-80b3-769d4b6230a7/

SH256 hash:

6e00280284f58421b65d2b99251d9e3cc221d83802ed72475de8833ff1807906

MD5 hash:

11e62434ec3a49887434657b4d79a9f6

SHA1 hash:

5b42b431653f550ec74c18e520b2eca18cd1fb73

Detections:

AgentTesla

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/69479671-7a7e-4af2-80b3-769d4b6230a7/

Parent samples :

b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc
a4aeb63141d720f906625b4dc4d9df1360b7a5daa310df980599b143d592b850
3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f
c46ba3a9e3e5d8261d7eab8a1c46502642f592c3cc15dea07677db1398dc689d
444fb4871f9ee687f90ecf33223c91bbf263a7d66f1c665d653ce71559c557bf

SH256 hash:

3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f

MD5 hash:

3c582d4727edaa1c78c7d8030aa54f36

SHA1 hash:

0c6d6f5cab8f21e82ced364b93aba0a21c0798a0

Detections:

INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438

Link:

https://www.unpac.me/results/69479671-7a7e-4af2-80b3-769d4b6230a7/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3c5f23935105/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3c5f239351056149025c562c8ad854bb85d48fd0e1aa5d3fa298bf5638ad045f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample