MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e3fd118a25473a4efba75d9e99a5aebe0f78779aaf6fb73984321ef119cd8c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	3e3fd118a25473a4efba75d9e99a5aebe0f78779aaf6fb73984321ef119cd8c0
SHA3-384 hash:	f5a7681979e119c6cad66af801df3e0d0caa6848ef85689e85bad042eafa3289abb1f7def427bad67b9cbea1e684fcf8
SHA1 hash:	ada3ec7a5da713eb4007544ae2561c5074298747
MD5 hash:	89a055d1a1149d23f4d11e894b275c25
humanhash:	utah-eight-eleven-magnesium
File name:	RFQ_#428156.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	888'320 bytes
First seen:	2022-02-09 07:43:21 UTC
Last seen:	2022-02-09 10:06:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:D43Jg2WYzNEAKECHn/aCQLpad56WLs6iXAa5p4P2+pysZtlKvG8tCPh2RkzW+Seg:Og2/OEDNO6FXj49D2u8wZ2RRea9
Threatray	15'452 similar samples on MalwareBazaar
TLSH	T17015BE2F187F213AC5BCDBB14984CD2FB992CD663533A41D298636D956366F270C222F
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/239289/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.25375.31057.22092.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Unauthorized injection to a recently created process

Creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed replace.exe

Link:

https://www.filescan.io/uploads/620370d14077c8b9a0253247/reports/e4573e25-2eb0-4548-aa35-abe5fcd46bfc/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a9337f53-3298-4fb2-8081-e6506eaf3b5b

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/936613

Behaviour

Behavior Graph:

n/a

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/3e3fd118a25473a4efba75d9e99a5aebe0f78779aaf6fb73984321ef119cd8c0/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-02-09 07:44:14 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 27 (77.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hy75cgfckrz2j352oxm6tgs25pqppb3zvl3pw44yimq66em43daa._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

014b3137818fe9c6b66f870dfb5a2d59ea9e78ef414cb28dae5142e9eeb1736c

AgentTesla

59a1ca93228d0609cf40c5e6698e8d192553064d01a25f21fa4f240381d765fa

AgentTesla

6eea5979c54077c3ef28f0a9900fd8779a1aeee9456aec1978c9a56472046408

AgentTesla

865be6910571e1334ef42b0396a44f76c45ad6048132da31f5599fe2dcfa2081

AgentTesla

9b49a9b7baa2dd6642fcc3c97976f6f1ddb0f8d6b4261ce4b32583c75a572e4e

AgentTesla

e59718548b97bf603ea0b9563a4521bccd408e06492012082249446d43b5de71

AgentTesla

f04d5b287971f60d5f04b262f3714a790b7d7c9b591ab88faa1d1f5244792d09

AgentTesla

+ 15'442 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/220209-jkvteahgek/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Drops file in Windows directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

e90fd95f44fe64dae1defdad20c7ae6b1ec2c806cbf483835d77d2ce7a088d00

MD5 hash:

3521016d39e80825b704eac203c53e00

SHA1 hash:

f20ca2b3d5e7e6b6fbffa91ab166eab0d137e65d

Link:

https://www.unpac.me/results/ff5b1fa3-a787-43f0-913d-079c0cf9138d/

SH256 hash:

26256f6678ab25a954aa0e81d7468000a6ba89fd0cb8055964ab2b6d0bcf35c0

MD5 hash:

fd2f3c3aa453d9825608ade06e105c04

SHA1 hash:

a4ed553f91f92a4ea7cf381205fadb8b9891f3cf

Link:

https://www.unpac.me/results/ff5b1fa3-a787-43f0-913d-079c0cf9138d/

SH256 hash:

0cc119786b104cf0aa261a208bf38802b339774ff3d7a42afcd8329d2d7d21c9

MD5 hash:

263b5190f7ac42d83c756dcdf38147bb

SHA1 hash:

78f419fe3936ed7d603706c47230cd3e6ff79ffe

Link:

https://www.unpac.me/results/ff5b1fa3-a787-43f0-913d-079c0cf9138d/

SH256 hash:

3e3fd118a25473a4efba75d9e99a5aebe0f78779aaf6fb73984321ef119cd8c0

MD5 hash:

89a055d1a1149d23f4d11e894b275c25

SHA1 hash:

ada3ec7a5da713eb4007544ae2561c5074298747

Link:

https://www.unpac.me/results/ff5b1fa3-a787-43f0-913d-079c0cf9138d/

Malware family:

Agent Tesla v3

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/3e3fd118a254/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.