MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d0816e876a59f4e3b56bd2105122ef69499f79bab375b0956716494eb286dbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d0816e876a59f4e3b56bd2105122ef69499f79bab375b0956716494eb286dbd
SHA3-384 hash: ded6e1e772c90383de9c27b86435d6954881662f3b157d8cd75a2e96fab311ac1fd124069988cb12f2f5a094caa316e9
SHA1 hash: 9162e9e76e014575f675ac989e7a3f6101d8dc57
MD5 hash: 6292cdf074922601a8f882921ca08c69
humanhash: sixteen-emma-pip-shade
File name:SecuriteInfo.com.Win32.TrojanX-gen.28883.16875
Download: download sample
Signature AgentTesla
Create hunting rule
File size:897'024 bytes
First seen:2023-06-19 10:33:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:fQYqtm8OqKuQ2AHokZ1Rely+0BbSILMv3+FlYILz:Y+8OgFALvRd+/mMvuX
Threatray 5'391 similar samples on MalwareBazaar
TLSH T10015E0243A790F56E47D97F94441723117BA6A6A783ED3284FD3B0DB1A62F410E51F23
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.TrojanX-gen.28883.16875
Verdict:
Malicious activity
Analysis date:
2023-06-19 10:34:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f45bdeb4-32fd-4c6a-bb10-5afa8c21e221

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/400373/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.28883.16875.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a window
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/64902f1b10461c2d676a66a1/reports/919d8fa1-c9d8-409c-b2cb-fb1d6071290a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/3d0816e876a59f4e3b56bd2105122ef69499f79bab375b0956716494eb286dbd
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/28390a21-1bb5-41d1-aa2a-1328197421a0
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1257277
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3d0816e876a59f4e3b56bd2105122ef69499f79bab375b0956716494eb286dbd/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-06-19 08:16:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=huebn2dwuwpu4o2wxuqqkero62kjt543vm3vwckwofsjj2zinw6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
107f5059b55ddfab8351c5369f43325f2d051aa41f5bbfe94a48ce577626a726
AgentTesla
1c834a9e0b395b4544646c67f8a12972256500cbabb5b71a7433548e8b558920
AgentTesla
1e0970459d115bde0c455a543f92bac5f17bdbcaa716791704792c78be82f299
AgentTesla
242e20fc56e288cfc053bde6513329683785b487787bf209fd94a5215110552b
AgentTesla
2e5e690fe5a9607c51574cd1e8444591a9dd524fafc78911ff9f09ee5242bff1
AgentTesla
36cb70021e8a153c22312876626b4143dc1cca60862d667d2af0c95a1fb9e8ac
AgentTesla
39893af7f960c76c20ab2b99e5caa2acabab3c7fc01e47791586f451eba5be5b
AgentTesla
c7eb221558c49c1bc163ed223f2fd9847c4f1bce98401c779cbcdd5738b54edc
AgentTesla
cf754ba143aca919dc53b8869d18ceb489014003092559062018193d6e0928bb
AgentTesla
+ 5'381 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230619-ml4pgsdc55/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
a8fabf2533eb7bc51f440652b967da9d5e2b6ddbfc6f83f9525f5f0f8fdb92ad
MD5 hash:
f64c77f84c44d9c906a43d62b863565f
SHA1 hash:
ebf89849a31f4644f8f3b90589b3232fa7bf4c3d
Link:
https://www.unpac.me/results/787968dc-d19b-4143-9ebb-b9099cc45742/
SH256 hash:
52f358d201e81d3a0391cedd3042e2f957555b77aa49559f7fb810bbb7673ba1
MD5 hash:
c785ddc46141af772c75101d17c46a41
SHA1 hash:
e248723b6f60cc7607980d07172b64c33b2b2f15
Link:
https://www.unpac.me/results/787968dc-d19b-4143-9ebb-b9099cc45742/
SH256 hash:
8f8f487b2fbaa2ba822ae6de713358efdf6145c6293d885f0fd3375d131f0e28
MD5 hash:
02a922265d7b3e842ba5d87d36b6b404
SHA1 hash:
d67ee280ae1ca3c57d0de49517008f130a0ea0a0
Link:
https://www.unpac.me/results/787968dc-d19b-4143-9ebb-b9099cc45742/
SH256 hash:
d2ebd3a6d8d4851e929ace6451b49e57113dd84f2d60c293f6e79b94a42183d4
MD5 hash:
02619cb58a6d438fde337cc313ca6db5
SHA1 hash:
cf7ce53022c1128d54ec45db8dba3d59f42a5137
Link:
https://www.unpac.me/results/787968dc-d19b-4143-9ebb-b9099cc45742/
SH256 hash:
649ef0379c18e32d5867c0a9611a000a5ae345e2ad99d6f5dc57f88e13d8477e
MD5 hash:
7f3c084034fc188a2b4626c218d5db3e
SHA1 hash:
11afead9bbf2d55d9e9bc036a16085a5a4ae3461
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/787968dc-d19b-4143-9ebb-b9099cc45742/
SH256 hash:
3d0816e876a59f4e3b56bd2105122ef69499f79bab375b0956716494eb286dbd
MD5 hash:
6292cdf074922601a8f882921ca08c69
SHA1 hash:
9162e9e76e014575f675ac989e7a3f6101d8dc57
Link:
https://www.unpac.me/results/787968dc-d19b-4143-9ebb-b9099cc45742/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3d0816e876a5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d0816e876a59f4e3b56bd2105122ef69499f79bab375b0956716494eb286dbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/400373/

Comments