MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3fbab4d8090fb6109b890d24c1e457db6e3f6bd5e17c6be2f2cb8448d53d5ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3fbab4d8090fb6109b890d24c1e457db6e3f6bd5e17c6be2f2cb8448d53d5ab
SHA3-384 hash: 1e935b59d1a214ab4078980ac3693f79926a8200a2aa1e1bce45c11f7b45c65d25a30ffd3359e5a5c1b247417078a2ef
SHA1 hash: c11b8cd74cc94a355e52b1a7c3b847e826c3a6c6
MD5 hash: 438669903956588f4d2d38af36d8a576
humanhash: ceiling-network-dakota-hotel
File name:PO451033200.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:708'608 bytes
First seen:2023-05-25 10:03:49 UTC
Last seen:2023-05-26 08:08:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:8aWIm6lVvtzZBEP85HE19rt764nNwXWjdClE1JOjXFE6gtffEWtHEZmxG:RTmIt9BEP8JE/rveqdClE/g0tNBG
Threatray 4'238 similar samples on MalwareBazaar
TLSH T1C9E412A0D5165248FEBF0FB00914A7B42EAEBEA9B4B0F2171C4BF1DDAA327470513617
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 3119113da9a9a929 (8 x AgentTesla)
Reporter TeamDreier
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
254
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO451033200.exe
Verdict:
Malicious activity
Analysis date:
2023-05-25 10:05:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a3dc5cf0-9729-4915-9610-9d6be2779718

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/391539/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/646f3297f6a79f331926b34a/reports/de8d5645-43f2-465f-94c2-83dec60bb292/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b3fbab4d8090fb6109b890d24c1e457db6e3f6bd5e17c6be2f2cb8448d53d5ab
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ee870dea-91ab-4a73-9377-c152c2de796e
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1242313
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected Telegram RAT
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3fbab4d8090fb6109b890d24c1e457db6e3f6bd5e17c6be2f2cb8448d53d5ab/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-05-25 03:30:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
17 of 36 (47.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wp52wtmasd5wccnysdjeyhsfpw3oh5v5lyl4nprpfs4ejdkt2wvq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
00cf6e9a873007d1f11859d3e30c85bda6f137cfbc53cd0bc9a4ac77a6ad5b04
AgentTesla
0e77fc7adca97943ad5bca6f1cd20d05e80bcdda01b29087bf1d6fccd4379063
AgentTesla
389cd12974a382686c0f491549b4bbe32c2dc9604b0b3a193ee4fb30ede8335d
AgentTesla
4229ac95a7cd9cc9eb93d0d77a73c9120aff761dbaf18fd51b23dfa766408137
AgentTesla
5c55eec6f12aa60ac02540ebb2af7b7780d148d76a07ad27bfad0d4f3bc1a067
AgentTesla
9934bdb2357968d6993f6ea0ce78deb44b8f502144057bd3e74977675326a447
AgentTesla
ab08bdbb5cee3c7c6fe2d7de4c8b7c383316fe7e7dd467f6dfa81dfbe443680b
AgentTesla
cd3f84c42ebdd57e9b3679216ef581b466aa1a646728156155a41055b070e788
AgentTesla
da108473566740a4ecd7f86677ee7a22779808be300f3329ca4a6d8877d0fcdf
AgentTesla
e5a75ed3a164d322279af143c007028a5e94a52c11e4fa674c37a48c79237d27
AgentTesla
+ 4'228 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230525-l3xrtshg4x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot6277498666:AAH4URlmeSysUKKZG20OTvrve55BRMLEu_o/
Unpacked files
SH256 hash:
2524de4e4c2240fc44c121e98f3af40b10a69ebf70777d76fa4d9366f08c0118
MD5 hash:
9f0b0835543031aadf50e2fcd605347d
SHA1 hash:
a1fed531f9ae9ddfcd827b2b3d045dc82e827ce8
Link:
https://www.unpac.me/results/5d2bd200-4288-465c-a8d8-46151a2130e3/
SH256 hash:
16c255190eaaf1b60ec7d07abcac5f614ea197cee2416ca9d01bb563c526c87d
MD5 hash:
fb4ed205b442f470bbf10913128efdcb
SHA1 hash:
9a0a4c5ae429769e3253a9a3daefa24270b87a5b
Link:
https://www.unpac.me/results/5d2bd200-4288-465c-a8d8-46151a2130e3/
Parent samples :
ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397
de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
SH256 hash:
b2876080a8892ec02a11cc322cc18952d45f9e419c1cb6d4d070860c59fe87eb
MD5 hash:
803e0c67b76960ff5d9ccb360ba9636b
SHA1 hash:
836d339682618638c6b2e3d156ad66a56e4f9ba5
Link:
https://www.unpac.me/results/5d2bd200-4288-465c-a8d8-46151a2130e3/
SH256 hash:
441c016ca970118ce9a0f1245460827c2763d93fe7e14efb50cc05d97ddb06da
MD5 hash:
a8e94ba5ab5a04aa4a67f02034eaf6ed
SHA1 hash:
813dd8f9749052352cbd450286b345e0cd09a5da
Link:
https://www.unpac.me/results/5d2bd200-4288-465c-a8d8-46151a2130e3/
SH256 hash:
f9021a9e1610a19bafd9f21c3ae02c8d4311e51c26088bad0b4656d12696269f
MD5 hash:
10a323a5614f656ff87524ec3a3954ea
SHA1 hash:
31fe827daa419d117c8ac75fff8253c57cb014d7
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/5d2bd200-4288-465c-a8d8-46151a2130e3/
Parent samples :
5c55eec6f12aa60ac02540ebb2af7b7780d148d76a07ad27bfad0d4f3bc1a067
0e77fc7adca97943ad5bca6f1cd20d05e80bcdda01b29087bf1d6fccd4379063
b3fbab4d8090fb6109b890d24c1e457db6e3f6bd5e17c6be2f2cb8448d53d5ab
92a4f2858bb9f3e546b315c52ee4e07903125b02f55c23cc8ae3e32e2012b2e0
577593e5d16e4c0439339d4345505db0eb1595670ebdb271feaeaab510fd8b56
d9306a1c01d5697b35534bd8156c06c6a18bc9b9f582a53de124534f35d0fa74
f45d13987da07c44c15886a61b0534254e8dfc55b9dca16156df5e2a21bfc5fd
SH256 hash:
b3fbab4d8090fb6109b890d24c1e457db6e3f6bd5e17c6be2f2cb8448d53d5ab
MD5 hash:
438669903956588f4d2d38af36d8a576
SHA1 hash:
c11b8cd74cc94a355e52b1a7c3b847e826c3a6c6
Link:
https://www.unpac.me/results/5d2bd200-4288-465c-a8d8-46151a2130e3/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b3fbab4d8090/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b3fbab4d8090fb6109b890d24c1e457db6e3f6bd5e17c6be2f2cb8448d53d5ab

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/391539/

Comments