MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3f8e456aeaba0afc976104eeec20357a09e59da003df7061c954cb434f877ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3f8e456aeaba0afc976104eeec20357a09e59da003df7061c954cb434f877ef
SHA3-384 hash: 31223fc1379c1ccb18a418faa7f85bd07a649a13028551dd3f4fb132b0ab2a2a1ffd3b7757edf69dd4c4d7e0ce643258
SHA1 hash: e9fff16b367219860a91bc1981c2a5862f164bbe
MD5 hash: 278d42baf2d3a78a56367802b68335c8
humanhash: whiskey-network-kilo-charlie
File name:e-dekont.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:979'456 bytes
First seen:2023-09-12 09:47:45 UTC
Last seen:2023-09-25 08:12:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:SfjPYyVFtEFDy6sIdqU35MGUn5jpw5/jlLExR4mlcD4gNZjX+ZF3:Srg+FtEFGSd2GUnp+/9ExR4yWtOZF
Threatray 5'712 similar samples on MalwareBazaar
TLSH T110255DD2F150CDEAEC6B45F17D2AA5302493BE9D98A4410C569EBB1766F3342209FE0F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon eeacac8cb6e2ba86 (561 x SnakeKeylogger, 142 x AgentTesla, 40 x Formbook)
Reporter abuse_ch
Tags:AgentTesla exe geo TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
300
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
e-dekont.exe
Verdict:
Malicious activity
Analysis date:
2023-09-12 09:56:04 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/ee7c9577-e2f6-42c9-9d57-01fd2d68db85

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448135/
Detection(s):
Porcupine.Malware.58887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Restart of the analyzed sample
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/650033da9bae8a378553ab41/reports/1fa6e9bd-66b7-4778-86c8-6c377a4be4b0/overview
Verdict:
Malicious
Labled as:
Ransom.Loki.Generic
Link:
https://www.hybrid-analysis.com/sample/b3f8e456aeaba0afc976104eeec20357a09e59da003df7061c954cb434f877ef
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/81181f34-909c-4154-9d3c-d761938ebe77
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3f8e456aeaba0afc976104eeec20357a09e59da003df7061c954cb434f877ef/
Threat name:
ByteCode-MSIL.Ransomware.Loki
Create hunting rule
Status:
Malicious
First seen:
2023-09-12 07:41:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
18 of 22 (81.82%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wp4oivvovoqk7slwcbho5qqdk6qj4wo2aa67obq4svglinhyo7xq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1f896398b69e22be7442bfd778d704b1e3b0961a51a8307e175d0876f8b67055
AgentTesla
20ae755cd163b0421ca9c12bc545e9bc22e256a64553ff27423c6e3146a05298
AgentTesla
372293f19446ed57ca833445d5d1efd66a6e4fc56ce5fd3164de5077845f2e87
AgentTesla
4f04a42a32afc88988279c6bd13c58623b9d8989d11119be3f1e3a35fe4d7fa0
AgentTesla
7af30a8f4780aa9bcc3ec75b529c8cc6b2a110c90d2b521761e744179534d410
AgentTesla
7bb0c7435eac35a50637bb58058fb0b71629b39cc0e7222b991cefeaffdc79a5
AgentTesla
a1b22bb99dfebf6b3fc3fa288b770d64120cb17e0c9d904aac2f8a813b47e579
AgentTesla
afaeeb8f276bbc3a0e313afd63200cc6437d4c344a658ce3ee0582a8b68a7a1c
AgentTesla
c973ac0f49c3e9fe8acb6116504cce59e13c040105707d3a241802c3e53df783
AgentTesla
+ 5'702 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230912-lssecsbe3w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://discord.com/api/webhooks/1150504726962647050/THqFlNLkhMso6vGcDeZibodDuV-dXvitE8cLmgt6uXXGYmo3J0kgOzNvaJD3jT1YvYP3
Unpacked files
SH256 hash:
9a63b62a1296933300f9cda87fefbdfc9f55ee908575a2130c641c9fd0c4f830
MD5 hash:
651ffbf7723d66c959851ec6c450fba2
SHA1 hash:
f7cf3587def824a298ae36da8ce82c62e2245f48
Link:
https://www.unpac.me/results/e62b9de0-6add-42bd-baf9-54100b26877d/
SH256 hash:
02984b6e917e2a3a94c977874bd48c717e9f71114a42807d19f54887c870799d
MD5 hash:
e2c25aa1a36c55fe8c08842b41e820ee
SHA1 hash:
826d65eab027bee01819e975dfafb4879bde0c71
Link:
https://www.unpac.me/results/e62b9de0-6add-42bd-baf9-54100b26877d/
SH256 hash:
33b8648f67e3735ba82a7ae93c94680b9d1676214e44b3f3c5e44e1ebcf95299
MD5 hash:
ec9115ddddd9debb9e48cff4838d3d95
SHA1 hash:
7fc0b8605716db32616e68bf8a4e537815291e9e
Link:
https://www.unpac.me/results/e62b9de0-6add-42bd-baf9-54100b26877d/
SH256 hash:
a93ab27d9bd9aa5b52288ff259e1dd2e8de2c873ee8fd5bbae64bca6f7624ce0
MD5 hash:
f2a2d829d920d375609a49544173df5a
SHA1 hash:
2af0e17de7935177d0a503ec980836fae9e17920
Link:
https://www.unpac.me/results/e62b9de0-6add-42bd-baf9-54100b26877d/
SH256 hash:
b3f8e456aeaba0afc976104eeec20357a09e59da003df7061c954cb434f877ef
MD5 hash:
278d42baf2d3a78a56367802b68335c8
SHA1 hash:
e9fff16b367219860a91bc1981c2a5862f164bbe
Link:
https://www.unpac.me/results/e62b9de0-6add-42bd-baf9-54100b26877d/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b3f8e456aeab/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3f8e456aeaba0afc976104eeec20357a09e59da003df7061c954cb434f877ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b3f8e456aeaba0afc976104eeec20357a09e59da003df7061c954cb434f877ef

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/448135/

Comments