MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 961b3c31dce2146e97c694b3d02e9818b7e637c569c2b9c034c5f4e713bb7a5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	961b3c31dce2146e97c694b3d02e9818b7e637c569c2b9c034c5f4e713bb7a5b
SHA3-384 hash:	b7bac34fa4bc9cf9d21a75d340df42093d6606bb857511831680bbb95106969802063174e23ddc0c5249ded220080d96
SHA1 hash:	10096bde4ef31eae4a3b3c34a9a8d5df4e249a7f
MD5 hash:	21cb125d519fedecf9c3c9ebc280e009
humanhash:	shade-arizona-kilo-johnny
File name:	RFQ89188945.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	24'624 bytes
First seen:	2022-03-30 13:42:22 UTC
Last seen:	2022-03-30 14:46:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	384:1ffMKpEUC2ahf9vwEG9/XwJwq6uJfq2GSLwqWymbC4I/AfLRKtU9j9hOy5:pxiURt2GLjOal9hR
Threatray	15'470 similar samples on MalwareBazaar
TLSH	T144B25C13EB4B1412DC1B5F3115A885065FB5B3C0AAABCAAF3468821CDFD37D71B65225
Reporter	cocaman
Tags:	AgentTesla exe RFQ

Intelligence

File Origin

# of uploads :

# of downloads :

245

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/259701/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.1264.1619.27350.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Reading critical registry keys

DNS request

Creating a file in the %AppData% subdirectories

Creating a window

Query of malicious DNS domain

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated overlay packed packed replace.exe

Link:

https://www.filescan.io/uploads/62445e689253b276b7a814f2/reports/b295ae49-54c4-4338-a8a0-721155e7df9f/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2f8b39f2-1f4a-4de4-a1f3-cda2aad52077

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/967608

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/961b3c31dce2146e97c694b3d02e9818b7e637c569c2b9c034c5f4e713bb7a5b/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-03-30 13:43:04 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=syntymo44ikg5f6gssz5aluydc36mn6fnhbltqbuyx2ooe53pjnq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5d44448d9368f5ec2b3594446bca10ae98f173176a4e9a55fd239c3c6d9c6edd

AgentTesla

91db81cd38b9f713767e35c4012057b99734e8e0e889af77935c6a0b47eedcbb

AgentTesla

9784eb9c33903d61e2fe75cf1d511adfb15d19af9876ea6b7c48f9b20e661000

AgentTesla

dc5eec99aa11a84baf9db82822e5367fb90f34304a660df4831f6f4cb4979e13

AgentTesla

defbeba113680db4e014a2b34be77a64529d1e0d5fb837e732eec92b842d364d

AgentTesla

+ 15'460 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/220330-qz8gdaccf2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot5298291290:AAE9piKcDhvGMUbIbyr1dEgpEJmq2He_z0c/sendDocument

Unpacked files

SH256 hash:

961b3c31dce2146e97c694b3d02e9818b7e637c569c2b9c034c5f4e713bb7a5b

MD5 hash:

21cb125d519fedecf9c3c9ebc280e009

SHA1 hash:

10096bde4ef31eae4a3b3c34a9a8d5df4e249a7f

Link:

https://www.unpac.me/results/4b3d8275-5270-451a-9f7e-b3f7d4e55779/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/961b3c31dce2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/961b3c31dce2146e97c694b3d02e9818b7e637c569c2b9c034c5f4e713bb7a5b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_65628c146ace93037fc58659f14bd35f Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates