MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024
SHA3-384 hash: 13f2f7afc83723d62818d2378b0142b14a5c2a0240f214f06c70712b7323711722b1a071c19c2b35580482a26e74c8ac
SHA1 hash: 6cf5a7c53a29630200d698b9318ddba78086b01c
MD5 hash: d1d6a9bebef27edf102e440b4653aa97
humanhash: friend-dakota-hotel-wisconsin
File name:3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'086'464 bytes
First seen:2020-11-11 10:50:33 UTC
Last seen:2020-11-15 22:35:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:m0jZI+s1u3SkJFRxCre3x86WnqB/8jdQ++22:m0jZQY3B/TrZWnqBkZQ+z
Threatray 10'050 similar samples on MalwareBazaar
TLSH ED35DFF89346EA9BCD0F013FA8493D22E2869F26CAED958557D5B03D13BC70E569048F
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 13:50:23 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3epjyxtojpg6xjiytzmxpwf3tfeja7j4ps74qzwfdhwkzonyasa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
22b5a335c60ba26745ed636f92af204ef6ba6b02f53b8b7538e940b933f135c0
AgentTesla
33a99ba14b9e93cef87a604f7cf417ecec809ab10574a6aef214ca39454144ef
AgentTesla
47ed9a694769d7cb9419f9a7250c67d109567589767862e20669be81536c60ea
AgentTesla
9029fc110d6ad30af1c140d2c7af2192b17c04986ba7bacebed72d58c84241a7
AgentTesla
917de3d72af9798430cb2287a3653d296351f885d91c6a76cf9d9a299b00967e
AgentTesla
a02fab001fe08ddb9a1ff1113714164bfb779c3c1829e0db5de65a9174f3af7c
AgentTesla
a9709d7020321dcdbc54e01003105e0e092040bccba2aed0701647c2cf0312c8
AgentTesla
dfac2f53e645d02d3819efb2ed6b03d162294675b5445b78f1e9946095354b8a
AgentTesla
f413624c125a8e6e6e8f4ece883a646fe784bc5a8f4f21185da1df43adc76da1
AgentTesla
f6dae5ff37232524f545d43bc3de780c98b0ad6ccdc2058b5e7b35c046a1bd8a
AgentTesla
+ 10'040 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201111-jjw9hmgefj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024
MD5 hash:
d1d6a9bebef27edf102e440b4653aa97
SHA1 hash:
6cf5a7c53a29630200d698b9318ddba78086b01c
Link:
https://www.unpac.me/results/a43e36b6-8da8-4a87-826a-78121b7e7bf0/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/a43e36b6-8da8-4a87-826a-78121b7e7bf0/
SH256 hash:
cc53153fd6b341a1ae3c6c98359036a910d7524407071bce280350105d4abae2
MD5 hash:
e0de7c091c8c60b03d89f068d4d3bbb7
SHA1 hash:
2740bf441986c54b2e877d2fcd7333be4b07e2a0
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/a43e36b6-8da8-4a87-826a-78121b7e7bf0/
Parent samples :
9029fc110d6ad30af1c140d2c7af2192b17c04986ba7bacebed72d58c84241a7
33a99ba14b9e93cef87a604f7cf417ecec809ab10574a6aef214ca39454144ef
af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687
3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024
16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9
2724536d5c8f56b46361fe1801cec990b885938dc7f1ef031a399065678ceb71
20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac
SH256 hash:
8b82d64929443c28da5e6b2f6de07100ec53a5875fb6ce4d2ff626ccdbe2d456
MD5 hash:
acf664f09ed90435c7767ff65407076f
SHA1 hash:
9466b055196252a0569b780564cc955a47ef030f
Link:
https://www.unpac.me/results/a43e36b6-8da8-4a87-826a-78121b7e7bf0/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_extracted_bin
Create hunting rule
Author:James_inthe_box
Description:AgentTesla extracted
Rule name:AgentTesla_mod_tough_bin
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:agent_tesla_2019
Create hunting rule
Author:jeFF0Falltrades
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments