MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d932a053e1421f810d277c21eba678f239b066169b1cfc21e380a135d7c8fd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	3d932a053e1421f810d277c21eba678f239b066169b1cfc21e380a135d7c8fd1
SHA3-384 hash:	13f87a923f34e61b2de437c3d1964980c28201f602ad3915b00bafd5707aa39b8ac2e6fbfda1c682a28c128d6d5256c5
SHA1 hash:	25d6cb7971e22d3ca89a85ccbdc5710343ca684f
MD5 hash:	db8383ed905c7aa5948410df3612bdee
humanhash:	king-eight-artist-equal
File name:	MV AMIS WEALTH CTM USD 40,000.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	740'864 bytes
First seen:	2022-01-31 05:30:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:pcqgcOVO7JvhUwJStsFzRts8TGBd3LSYqAIv0qmInRh1:pcqsVOVvKwJSyxYX3lVIt
Threatray	14'362 similar samples on MalwareBazaar
TLSH	T15AF4D0B0A0B74691F10B8A74616DF96402F234E3F9C68E785B253685CFEAF943E4560F
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

MV AMIS WEALTH CTM USD 40,000.exe

Verdict:

Suspicious activity

Analysis date:

2022-01-31 05:53:48 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b6f3a044-5c8e-4eb8-9cad-6320fb354946

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/228295/

Detection(s):

SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL

Sanesecurity.Rogue.0hr.20220131-0104.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Сreating synchronization primitives

Launching a process

Creating a file

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/61f77419d9e6538232d60a5f/reports/02354ed0-60d2-4149-b32f-351cf5a133d3/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e574ddf5-0b02-4001-a2f6-a88072693ce3

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.adwa.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/930547

Behaviour

Behavior Graph:

n/a

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/3d932a053e1421f810d277c21eba678f239b066169b1cfc21e380a135d7c8fd1/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-01-31 01:02:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hwjsubj6cqq7qegso7bb5othr4rzwbtbngy47qq6hafbgxl4r7iq._file

Verdict:

malicious

Label(s):

agenttesla

asyncrat

AgentTesla

6c26868470adaf2dbac1718393836da06c23fd53c9d0d9912642628912c8c2bb

AgentTesla

7ef2a4ddbdb6f28ec39e26bbd6883221326eaf51babfca78fdb27f1d5f4fdbe1

AgentTesla

810c07ceeef94fff269ad3c0891d5c329f39733b7cf49b1dc23e725182999593

AgentTesla

8f9a34a821f52b05d7ec60c32575e79faedea1dd0f30fd6537fc7928e47bd107

AgentTesla

96c34292c35dbb15c36078c6645e2ac7938aeae168167e1493b4e8476c20d3b8

AgentTesla

d03df98c136604138b930409e4c084ac694f1e0f571fbefae620cec8cd05d619

AgentTesla

d0eabfe28f6b77c25d883ad3e380620f1367082cc58f309e4d24dd1d2c3548c8

AgentTesla

f2359b5f5948852a94ec839a2616e5d277f7a03692e26b3c7ca981e0fa628742

AgentTesla

+ 14'352 additional samples on MalwareBazaar

Gathering data

Unpacked files

SH256 hash:

65a015562d9171ce1707830d2787f17591ac2cdf5bacedac592b318a4f1aff74

MD5 hash:

1e072069bcdcc58c6494e7746d864434

SHA1 hash:

fdbc203c44354c3afd737d8a057745951c253cbd

Link:

https://www.unpac.me/results/9cadcc97-1acd-4cb6-81b1-7976d2138945/

SH256 hash:

f1fdf3cc9532ee737ed8adc8a7dd5eb7f1a53f144472a704d18e80e722c8e217

MD5 hash:

cf810470d408d2aa771056eb5d1d71ff

SHA1 hash:

cb765f8b41bd774d232beec5f30f4c4872907926

Link:

https://www.unpac.me/results/9cadcc97-1acd-4cb6-81b1-7976d2138945/

SH256 hash:

6f1b89bc3013177c101fe4448340c48c0dd08d19017a798bd11c2d0f76be1fbc

MD5 hash:

60a604887b3616e3ed86d81fab0a9ebb

SHA1 hash:

8db84f5f4c569c86c69aff464b2ffc4ce3dafa20

Link:

https://www.unpac.me/results/9cadcc97-1acd-4cb6-81b1-7976d2138945/

SH256 hash:

3d932a053e1421f810d277c21eba678f239b066169b1cfc21e380a135d7c8fd1

MD5 hash:

db8383ed905c7aa5948410df3612bdee

SHA1 hash:

25d6cb7971e22d3ca89a85ccbdc5710343ca684f

Link:

https://www.unpac.me/results/9cadcc97-1acd-4cb6-81b1-7976d2138945/

Malware family:

Agent Tesla v3

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/3d932a053e14/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/3d932a053e1421f810d277c21eba678f239b066169b1cfc21e380a135d7c8fd1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.