MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d3b0128f3bd2fd0c85b37496812b834ae8b2a9bc454eab9d04748182da5d25d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d3b0128f3bd2fd0c85b37496812b834ae8b2a9bc454eab9d04748182da5d25d
SHA3-384 hash: 8143ceb96386b4885fd41fe84de7583bd734185fe712a2219b6d4113ca1017c2b7f94235229edbb34bb28a1aa21b164b
SHA1 hash: 38e28cbde2d4e9051e349f4377bc5fd4e731d551
MD5 hash: 7666650174081f5feb7cd4f012728291
humanhash: north-bulldog-grey-saturn
File name:Shipping Document.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:296'111 bytes
First seen:2023-02-21 08:59:34 UTC
Last seen:2023-02-21 09:13:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 6144:/Ya63y8UIO/30HWbfcotBrL74qhPzfQ4HNtrR4AijnHwW8Dml:/YVxU5/EHMfrL7DhPzfQ4B45zHwW6ml
Threatray 3'556 similar samples on MalwareBazaar
TLSH T1DE5412045375D1BBD1D70B350EBB998B3AB164266124B20F2F301F9A79B2790DE1FB92
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter cocaman
Tags:AgentTesla exe Shipping

Intelligence

File Origin
# of uploads :
3
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Shipping Document.exe
Verdict:
Malicious activity
Analysis date:
2023-02-21 09:02:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ad06a2c1-d0ec-4cc2-9f30-b48ac1483eae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/368573/
Detection(s):
SecuriteInfo.com.Trojan.Loader.1312.29302.27720.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/71921/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63f488154cf031c9c07a2f7f/reports/ccfd0095-d3bb-453f-8162-3120cc4dab8c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3d3b0128f3bd2fd0c85b37496812b834ae8b2a9bc454eab9d04748182da5d25d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e2f9b262-0944-43cf-8383-c30fed040e42
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1179614
Signature
Detected unpacking (overwrites its own PE header)
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3d3b0128f3bd2fd0c85b37496812b834ae8b2a9bc454eab9d04748182da5d25d/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-02-21 04:26:30 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
23 of 39 (58.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hu5qckhtxux5bsc3g5ewqevygsxiwku3yrkovooqi5ebqlnf2joq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05238efd964125503399743df334ea2ae9bdc4871c2ae1537b49874c6976f951
AgentTesla
5b4c337c8278f3ab74d88f54644ab8a9761d4d6455bf53cd5f3caa8d30eef5f8
AgentTesla
82d448cb2461440d0ab1777690a41e228118c36961d8ee506ce94a9622b8af5d
AgentTesla
8f81fd0cd66548518e82ab4238cf83a55989de7b1ab9099ef43892d0272b41e5
AgentTesla
9842d23cef4dc305ab6b8cd1ade477e1186d94cfd18861e1c87a55aff4d04c40
AgentTesla
b416c616f9d57f2a71eb4fd905a6a1d7c73e48f0240981d477136b3c448aeaa4
AgentTesla
c01f1d833bebebb74b248ea0b0c23abc1a70269f62513b1a8a0d1d33a4922d56
AgentTesla
eda76d518118e4843804277202fb22ac8239f7231775f411d0b36c2980919786
AgentTesla
f873aff34af07e0be6364498ef313f9e21454ba6fcab0a24c5da2a438de2770c
AgentTesla
+ 3'546 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230221-kya7laec22/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
53350cfdd5923a9a13c066ee2d41d29cc3e54372fd3776a314d93674c4d59653
MD5 hash:
cbdb5824012dbe9f7c08b0d2a0759dda
SHA1 hash:
b95b49c20dbfb397f8bb2d3cc6ba036281897998
Link:
https://www.unpac.me/results/7bd579a9-ce49-4c68-b365-7a26ccc96ebc/
SH256 hash:
94d341df30a3c6ce139f083130367e95fe8013493eb24492d45112229a10bb0d
MD5 hash:
679b96b9c6239afa9e77857541699ee5
SHA1 hash:
9460f7df2b036ab6be7eca0fb7b22aeeb76c033c
Link:
https://www.unpac.me/results/7bd579a9-ce49-4c68-b365-7a26ccc96ebc/
Parent samples :
720be830d608d17de8f83bde1fd7a90db5bd75ebad8fbe10d60ea4bd1fa9f760
1e78015efee2b6e94749afd35ae539a88520ff959e06ca20683c6d0d7218b4c2
22c4b05bcf26647a2464500666ec31c235599a73765d4cd3452721eb2cf2b020
0b4d7a81cb8f89e34562cd756540d3dd62176c0fa829d7dba9db2c727b92aef0
b017455b50865cfdd26486b8c6d8348294ee6fba27ea97eb2d94e6a56b7397b5
edc2598baa07918d489c7642acc5d1051506ca818323627769d3b4d6f218eacb
SH256 hash:
38bdef89810064d59177528f80cf6ace04acfb743195321fcada4fd7f576b9a1
MD5 hash:
f002d9e575d3e2d873f7d4be331a5615
SHA1 hash:
cc20d4b5e2a98c225b006a470cf02cb71052b659
Link:
https://www.unpac.me/results/7bd579a9-ce49-4c68-b365-7a26ccc96ebc/
SH256 hash:
3d3b0128f3bd2fd0c85b37496812b834ae8b2a9bc454eab9d04748182da5d25d
MD5 hash:
7666650174081f5feb7cd4f012728291
SHA1 hash:
38e28cbde2d4e9051e349f4377bc5fd4e731d551
Link:
https://www.unpac.me/results/7bd579a9-ce49-4c68-b365-7a26ccc96ebc/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3d3b0128f3bd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d3b0128f3bd2fd0c85b37496812b834ae8b2a9bc454eab9d04748182da5d25d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pe_imphash
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 077694f8e71ba304da202f9522402ccdc7f546985fe932cf841bf05960e96b66

AgentTesla

Executable exe 3d3b0128f3bd2fd0c85b37496812b834ae8b2a9bc454eab9d04748182da5d25d

(this sample)

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/368573/
  
Dropped by
SHA256 077694f8e71ba304da202f9522402ccdc7f546985fe932cf841bf05960e96b66
  
Dropped by
MD5 3133a24b46145061ef7c6a8f9679202d

Comments