MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 dc3c0dc5884f2252d2632da5c719e49080197ae9e06dd7438a31c65b800d3f84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 10
| SHA256 hash: | dc3c0dc5884f2252d2632da5c719e49080197ae9e06dd7438a31c65b800d3f84 |
|---|---|
| SHA3-384 hash: | e8a53019580489bf1954b77ee7b8b9536a7ddc0d0f9589ca495e9425de92b7d61810e6133f5aa3dcb0447c2106a53484 |
| SHA1 hash: | 00d0cc9b8346b2833938d0843ab6fec7047bd433 |
| MD5 hash: | 3c6717c101dfc91c08bd4550c746f7a6 |
| humanhash: | november-moon-beer-bacon |
| File name: | Motilaloswal Outstand Reminder.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 428'032 bytes |
| First seen: | 2021-03-09 15:55:10 UTC |
| Last seen: | 2021-03-11 06:18:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:AegdHdJNqL13WiNEAyw68C40DcY2V8xcNosp6:gUQimnweUV8C9 |
| Threatray | 3'119 similar samples on MalwareBazaar |
| TLSH | F59412A133AC5B21D9FD7BFA5533500C03BCAC12E122C75D8F8A70EA1E66F418A56A57 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
abuse_ch
Malspam distributing unidentified malware:HELO: host.purvainfosystems.in
Sending IP: 69.16.249.73
From: Shallet Caldeira <Shallet.caldeira@motilaloswal.com>
Subject: Outstanding Reminder.
Attachment: Motilaloswal Outstand Reminder.gz (contains "Motilaloswal Outstand Reminder.exe")
Intelligence
File Origin
# of uploads :
3
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Motilaloswal Outstand Reminder.exe
Verdict:
Suspicious activity
Analysis date:
2021-03-09 16:51:54 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Contains functionality to register a low level keyboard hook
Found malware configuration
Installs a global keyboard hook
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-03-09 08:30:43 UTC
AV detection:
28 of 47 (59.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 3'109 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
a25219ad5dd91a5d5694db73031214fa9f117ed4da6f20236492e8f1813a6727
MD5 hash:
906911011bb54ca69c23fa0b8b5045de
SHA1 hash:
dd347fc8dcce3ac1f63767a717a029cdbad9dddf
SH256 hash:
22dc8bd52dd1a9faed1715e921eedd5e92ecf953cd30c945300c7af9b8bc8ae4
MD5 hash:
f74ade78b6f15b366b01ab4b42a2cffa
SHA1 hash:
dcc2538b0e5f59da901323cf47044a3e3d7e4aff
SH256 hash:
1510861928b533e1529c1ffe7c6d57d9e5e928830d0afb28fd0fa730ff83fbdc
MD5 hash:
8f85df46a482b5b068ae7667bf1a33d6
SHA1 hash:
a210d369311aa4d709dc962c634174738576907e
SH256 hash:
dc3c0dc5884f2252d2632da5c719e49080197ae9e06dd7438a31c65b800d3f84
MD5 hash:
3c6717c101dfc91c08bd4550c746f7a6
SHA1 hash:
00d0cc9b8346b2833938d0843ab6fec7047bd433
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.