MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c78328ece4e85f59c8cc9cc01d5cf600aaff4ae7aa045bc3ffc2a3d8f0fd708. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c78328ece4e85f59c8cc9cc01d5cf600aaff4ae7aa045bc3ffc2a3d8f0fd708
SHA3-384 hash: 5c6a586588777ae1c98ab1a49d99176a1178a20eac4f6cd3e49769f4ec469cf5cc2219a77a7912f5c679ddbec3cf52b6
SHA1 hash: c81a7c378867efc0e210579a4a93349e06f94ba6
MD5 hash: 76b3dd57391e2d2439b226172dbc3ce6
humanhash: arizona-jupiter-tennis-minnesota
File name:NEW OFER LIST 2023_01_23.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:577'536 bytes
First seen:2023-01-23 10:20:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:qduJ66BQCsOmNeg7kAgxe374MUgKBynt9ajXWa:1JVW3O4yeUMMXWa
Threatray 24'949 similar samples on MalwareBazaar
TLSH T1AFC4125371B8C346CA7603F88C7C164C57B179825921E35F1EE2B0EDADA2F850B16A6B
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 2810f07110796900 (11 x AgentTesla, 2 x Formbook, 2 x SnakeKeylogger)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NEW OFER LIST 2023_01_23.exe
Verdict:
Malicious activity
Analysis date:
2023-01-23 10:23:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8c67fa97-e6fc-4bb4-b574-ae9b551d457e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/355841/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63ce5f912b351a3d0ea7df7c/reports/38b5bb7f-0813-4a5a-9b6c-acea4127ee55/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/64646c67-70fc-42e8-8ec8-ef03bc2bf9f1
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1156870
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c78328ece4e85f59c8cc9cc01d5cf600aaff4ae7aa045bc3ffc2a3d8f0fd708/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-01-23 09:28:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hr4dfdwoj2c7lhemzhgadvopmafk75fopkqelpb77qvd3dyp24ea._file
Verdict:
malicious
Similar samples:
011c5a93fcf5f1fda343e254b6be02737381be4df4bdec1aa07c8ad23b540599
AgentTesla
1326d9172aa0687e037a43b532cf2fb0e2ba90bff2e35efdebac87c3b06560f2
AgentTesla
175b18fc4d1ce73099a94c25d5fee0af5704e47b37803137368bdf416fc8a364
AgentTesla
24902a43196fd02d2939443510181c165980bd71e889dcff559ca25153c76d81
AgentTesla
64709b83e44493c9daef902de750d67a7dc071da29b2a82a8e79e4d6998f0621
AgentTesla
6600f2c51ef233a254c85c0a3070eb9a81046692dd9918de53213c23e26a733f
AgentTesla
a7d2bd1e968aea0e81664aa5aabd428a57d12bc8573611543ad72a57661180b8
AgentTesla
e071fb170a7fc7f20766716dd9ec26455f0a7b45bf9d6e5695e80a71a486a591
AgentTesla
+ 24'939 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection spyware stealer
Link:
https://tria.ge/reports/230123-mdncjaee6w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
08ff6b9bc2b79b2d82b9a38f89c6625d987e8bb72b579b71fd29098035591649
MD5 hash:
6295c9e1d5e739abe17b12c5710775e5
SHA1 hash:
d62ec5a2e7c00bb98d8d6904f064660e4fbbb648
Link:
https://www.unpac.me/results/5064a1b8-326b-4575-ac3d-4b7b217c0eba/
SH256 hash:
4ecf89aedd0e966504f78a3f37abae70722930f0d6ee4664fc7db3b4329cb1ca
MD5 hash:
f8a9cb1ded9a97923ec0a96fe6cc8021
SHA1 hash:
61fc675d3c3825c23c075d4b4d2c33530f389f5f
Link:
https://www.unpac.me/results/5064a1b8-326b-4575-ac3d-4b7b217c0eba/
SH256 hash:
6f0827aa821f1ec10ee3666c37fc877d8aba7882d75cfd17dd1cab6d18736f04
MD5 hash:
5e05bfefd0ded0bf2a434c265cafc005
SHA1 hash:
4f533bcee6ca130b6ef9af4c8deb69a557dfc1d8
Link:
https://www.unpac.me/results/5064a1b8-326b-4575-ac3d-4b7b217c0eba/
SH256 hash:
ab2f8dbc2b147528cecac6ea1a8886951c424be0b2026743b39d97f0cbabb04c
MD5 hash:
77ab42f4bbbf4565846eb8953192d71f
SHA1 hash:
3c662c756cc31867c0473716a74e777a65ced550
Link:
https://www.unpac.me/results/5064a1b8-326b-4575-ac3d-4b7b217c0eba/
SH256 hash:
20eda0a9b642a495ee216f13d2c37603ef860ff1aa1b8c89b2aa630a17574f71
MD5 hash:
d2dcd2d712c1f3c871e39fc27f889546
SHA1 hash:
167502f0388eb8c9525a048282600fa83d7254ad
Link:
https://www.unpac.me/results/5064a1b8-326b-4575-ac3d-4b7b217c0eba/
SH256 hash:
3c78328ece4e85f59c8cc9cc01d5cf600aaff4ae7aa045bc3ffc2a3d8f0fd708
MD5 hash:
76b3dd57391e2d2439b226172dbc3ce6
SHA1 hash:
c81a7c378867efc0e210579a4a93349e06f94ba6
Link:
https://www.unpac.me/results/5064a1b8-326b-4575-ac3d-4b7b217c0eba/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3c78328ece4e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/3c78328ece4e85f59c8cc9cc01d5cf600aaff4ae7aa045bc3ffc2a3d8f0fd708

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 44461d8034f2ecf675588fa2f6ec288ed37ccabf70975a93573d27e887ca26e8

AgentTesla

Executable exe 3c78328ece4e85f59c8cc9cc01d5cf600aaff4ae7aa045bc3ffc2a3d8f0fd708

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 44461d8034f2ecf675588fa2f6ec288ed37ccabf70975a93573d27e887ca26e8
Cape
Cape
https://www.capesandbox.com/analysis/355841/
  
Dropped by
MD5 39c9c8053e1b8fe837945fc9d2789494

Comments