MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d9753ff3f750d10fb81a94cdc1fdf1b4c8ff0f2e3750e7bf93c4baa23c95ab3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d9753ff3f750d10fb81a94cdc1fdf1b4c8ff0f2e3750e7bf93c4baa23c95ab3
SHA3-384 hash: f79ebd19713844264d5bc662d75e2e5cb066f9ee8ff4254c0ac956fdefee7093322e373f50d040f1c23a9149b406cb35
SHA1 hash: d337cfaeca968e1c9fc35d84c539b75a7571aa35
MD5 hash: 19b5bd5dbc998fdffd473773941904df
humanhash: fruit-neptune-carpet-coffee
File name:SKCM_20230515_009892823055402,PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:601'088 bytes
First seen:2023-05-16 10:26:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'633 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:JrysSmnXQGsZ1rF2C5p52WU1OwIGX7IhXiukBEIqzNub:9sbbNhdGX8tiuG8
Threatray 1'256 similar samples on MalwareBazaar
TLSH T12BD4F169A2FA0F67C37943F655B426420BB471937D27C93C0EDE34C9EA17F600968A93
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter threatcat_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SKCM_20230515_009892823055402,PDF.exe
Verdict:
Malicious activity
Analysis date:
2023-05-16 10:26:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0c943549-a3d0-4791-8bbf-5bd0c42b2618

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/390375/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67059574.3348.15649.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
floxif packed threat virus
Link:
https://www.filescan.io/uploads/64635a7888ceff553498a460/reports/12b565d0-40ed-4d12-8072-808d976e468b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/3d9753ff3f750d10fb81a94cdc1fdf1b4c8ff0f2e3750e7bf93c4baa23c95ab3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cabcf28f-37e1-4d54-963e-24b67467fe5e
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1234725
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Telegram RAT
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 867703 Sample: SKCM_20230515_0098928230554... Startdate: 16/05/2023 Architecture: WINDOWS Score: 100 42 Snort IDS alert for network traffic 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 9 other signatures 2->48 7 SKCM_20230515_009892823055402,PDF.exe 7 2->7         started        11 bpVkTfNeuDyD.exe 5 2->11         started        process3 file4 32 C:\Users\user\AppData\...\bpVkTfNeuDyD.exe, PE32 7->32 dropped 34 C:\Users\...\bpVkTfNeuDyD.exe:Zone.Identifier, ASCII 7->34 dropped 36 C:\Users\user\AppData\Local\...\tmpFFB7.tmp, XML 7->36 dropped 38 SKCM_20230515_0098...3055402,PDF.exe.log, ASCII 7->38 dropped 50 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->50 52 Uses schtasks.exe or at.exe to add and modify task schedules 7->52 54 Adds a directory exclusion to Windows Defender 7->54 56 Injects a PE file into a foreign processes 7->56 13 SKCM_20230515_009892823055402,PDF.exe 15 2 7->13         started        17 powershell.exe 21 7->17         started        19 schtasks.exe 1 7->19         started        58 Multi AV Scanner detection for dropped file 11->58 60 Machine Learning detection for dropped file 11->60 21 bpVkTfNeuDyD.exe 2 11->21         started        23 schtasks.exe 1 11->23         started        signatures5 process6 dnsIp7 40 api.telegram.org 149.154.167.220, 443, 49707, 49708 TELEGRAMRU United Kingdom 13->40 25 conhost.exe 17->25         started        28 conhost.exe 19->28         started        64 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->64 66 Tries to steal Mail credentials (via file / registry access) 21->66 68 Tries to harvest and steal browser information (history, passwords, etc) 21->68 30 conhost.exe 23->30         started        signatures8 process9 signatures10 62 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 25->62
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d9753ff3f750d10fb81a94cdc1fdf1b4c8ff0f2e3750e7bf93c4baa23c95ab3/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-15 14:40:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hwlvh7z7ougrb64bvfgnyh67dngi74hs4n2q467zhrf2ui6jlkzq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
38d4243f8cb750a5220bbb7e0a0acfad25ff6bc1cd41e281e8f8379dcd742d7c
AgentTesla
392ee3c9d47409b170b5e4d6f7eedf427bf1121be42b024a663340bed3025bd4
AgentTesla
3aeb2186089e92657ade4819a0b14ee7ef6f4e6ea314e224f2933e4940567b77
AgentTesla
4581026ca8972214b08a22a0b621d607997da7586b828e02bfab11a5ca5de33f
AgentTesla
baa855589cec9a4aeff9575393b8f2a46f5e2251dfc8f8cc009c5a6690ec9409
AgentTesla
baaba65de7ee0a52274e439f9cfc6e1ad5e55f74dc43644c33c27863c99f9c4e
AgentTesla
c6dcc5ea2ef3af8a214da77f1b3d14af29cc066fbcc952b291494ae321279edd
AgentTesla
d9672edbb45fefa3ca9a12a91c8d27727f3e5262c76cac9efbf67925d6d6fb78
AgentTesla
fd7a04ef2040fb5bc9216fe5deebd9cf7d1190e7fbdc0e15a42a6c8b639de167
AgentTesla
+ 1'246 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230516-mg376ahc5z/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot6277254729:AAH9hHYZNSDZac0nNvgmchkZF8WVRKU5dJ0/
Unpacked files
SH256 hash:
bfa7a39a6b13a72d4ce2cfe3846ff633168aba63ad62464ca4b8b1b24e757e79
MD5 hash:
f3f5d97c33fe711cc30b6a583f1be192
SHA1 hash:
6592039fb31c1efca674c9c9c08b18e760f6706c
Link:
https://www.unpac.me/results/122f9a88-5ace-4412-8d99-21b51ceaa449/
SH256 hash:
3b9b203bd33d33e1f98ef4fa2ce809dcabecad4b7cd3183c1a25c58db212a8c5
MD5 hash:
5a151b30dfe69c047cab1f4bfd5a9088
SHA1 hash:
22c5f93ace9ab3f669c34fec9f10738b3109ef83
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/122f9a88-5ace-4412-8d99-21b51ceaa449/
Parent samples :
81cd7d55388e715517b4f91ad4185a3ed27514cac314680eeb34cae3b839581b
bc2c9a0032b4118b2d862043c73ebbc2627c31f8fb8afb7bd28b8a27be225800
8c12b87a5074c0a18d717cc704bb90915829327c304e0c95384f88820f0215cb
70eddfd85da24eeaffddfdd6326c749326f098b597ce9c8eb79b3e69242a7801
3b0acc239747010ba9c56cf22b4ace536d82bf3748dfb14e8b977c07f8dc976d
392ee3c9d47409b170b5e4d6f7eedf427bf1121be42b024a663340bed3025bd4
1aff0eb2eee6fe5d70d00aee2db2f30cea5167c64ea80369eaaffc39c7e654f8
3d9753ff3f750d10fb81a94cdc1fdf1b4c8ff0f2e3750e7bf93c4baa23c95ab3
f1f712291194a7a1c0342f045b44a7199c14250ff478b0562e562e77b61c7a7b
SH256 hash:
b52c29ba9ef8996bdf721950d900db96f1befb9883eb38c2075528e60c7aabd4
MD5 hash:
7b6143d9d94c8b80d191b77d8b6d1ba2
SHA1 hash:
1c91704ff6da2a9dd8aaa2ff2d5a5f69a445f76b
Link:
https://www.unpac.me/results/122f9a88-5ace-4412-8d99-21b51ceaa449/
SH256 hash:
946a88b20bc256fb757b14b77a4a00d93b385dcd795e6be86b889c09a2285f57
MD5 hash:
dfc6137f5aaed09d456a6e26ebc7c094
SHA1 hash:
0dead64b4f37619ea8f87662091b66eb72b48706
Link:
https://www.unpac.me/results/122f9a88-5ace-4412-8d99-21b51ceaa449/
SH256 hash:
6722a58c81f6d11004e880bd8481acc423bf96afd46bf692f1562cfa4c5852bd
MD5 hash:
d92d2ba953be4be2d6f2bc859ec5c607
SHA1 hash:
05da51752277bd907ebcfb799524ec7655abbc3a
Link:
https://www.unpac.me/results/122f9a88-5ace-4412-8d99-21b51ceaa449/
SH256 hash:
3d9753ff3f750d10fb81a94cdc1fdf1b4c8ff0f2e3750e7bf93c4baa23c95ab3
MD5 hash:
19b5bd5dbc998fdffd473773941904df
SHA1 hash:
d337cfaeca968e1c9fc35d84c539b75a7571aa35
Link:
https://www.unpac.me/results/122f9a88-5ace-4412-8d99-21b51ceaa449/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 3d9753ff3f750d10fb81a94cdc1fdf1b4c8ff0f2e3750e7bf93c4baa23c95ab3

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/390375/

Comments