Edit tour

Windows Analysis Report
e3.exe

Overview

General Information

Sample Name:	e3.exe
Analysis ID:	626044
MD5:	e37f62c85961b9502a0d1599c37e390c
SHA1:	1135f2ee15ad11129b07e784e344b16acf07b612
SHA256:	63376e3e129b0513baec3a001a0bcc80ed859d0b4c347fd4491add3f54dccfaf
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected AntiVM3

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

May check the online IP address of the machine

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Uses a known web browser user agent for HTTP communication

Contains capabilities to detect virtual machines

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

e3.exe (PID: 6384 cmdline: "C:\Users\user\Desktop\e3.exe" MD5: E37F62C85961B9502A0D1599C37E390C)

schtasks.exe (PID: 5772 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PhOyTxcSdzas" /XML "C:\Users\user\AppData\Local\Temp\tmp799E.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

e3.exe (PID: 6540 cmdline: {path} MD5: E37F62C85961B9502A0D1599C37E390C)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot1341301202:AAHzCj-Eu3mWY1PQc6gP-IXoYKSfMPo3X2w/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Chat id": "1299507057", "Chat URL": "https://api.telegram.org/bot1341301202:AAHzCj-Eu3mWY1PQc6gP-IXoYKSfMPo3X2w/sendDocument"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.636427550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.636427550.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.407405620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.407405620.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.418778941.0000000006E10000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLAgent05	Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable	ditekSHen	0x9430:$s1: MARCUS.dll 0x14e04:$s1: MARCUS.dll 0x14eb8:$s1: MARCUS.dll 0xa188:$s2: GZipStream 0xa17b:$s3: MemoryStream 0xa28d:$s4: proj_name 0xa284:$s5: res_name
00000004.00000000.408635551.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.408635551.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.409431233.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.409431233.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.416036513.0000000003B3D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.416036513.0000000003B3D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.410001706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.410001706.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.419018802.0000000007170000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.413876682.0000000002871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.639291967.0000000002E55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.638824586.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.638824586.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.638824586.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.638824586.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x1df5:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x23c3:$m2: %image/jpg:Zone.Identifier\tmpG.tmp%urlkey%-f \Data\Tor\torrcp=%PostURL%127.0.0.1POST+%2B 0x290f:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401 0x1c8b:$m4: %startupfolder%\%insfolder%\%insname%/\%insfolder%\Software\Microsoft\Windows\CurrentVersion\Run%insregname%SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunTruehttp 0x1f16:$m5: \WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera
Process Memory Space: e3.exe PID: 6384	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: e3.exe PID: 6384	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: e3.exe PID: 6384	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: e3.exe PID: 6540	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: e3.exe PID: 6540	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: e3.exe PID: 6540	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e3.exe PID: 6540	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x46cae:$s1: get_kbok 0x746c5:$s1: get_kbok 0x4752e:$s2: get_CHoo 0x74f45:$s2: get_CHoo 0x480c9:$s3: set_passwordIsSet 0x75ae0:$s3: set_passwordIsSet 0x46b41:$s4: get_enableLog 0x74558:$s4: get_enableLog 0x45fa6:$g1: get_Clipboard 0x739bd:$g1: get_Clipboard 0x45fb4:$g2: get_Keyboard 0x739cb:$g2: get_Keyboard 0x45fc1:$g3: get_Password 0x739d8:$g3: get_Password 0x47408:$g4: get_CtrlKeyDown 0x74e1f:$g4: get_CtrlKeyDown 0x47418:$g5: get_ShiftKeyDown 0x74e2f:$g5: get_ShiftKeyDown 0x47429:$g6: get_AltKeyDown 0x74e40:$g6: get_AltKeyDown 0x98c9c:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.e3.exe.6e10000.4.unpack	MALWARE_Win_DLAgent05	Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable	ditekSHen	0x7830:$s1: MARCUS.dll 0x13204:$s1: MARCUS.dll 0x132b8:$s1: MARCUS.dll 0x8588:$s2: GZipStream 0x857b:$s3: MemoryStream 0x868d:$s4: proj_name 0x8684:$s5: res_name
4.0.e3.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.8.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.e3.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d38:$s1: get_kbok 0x3166c:$s2: get_CHoo 0x322c7:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x3526e:$s8: torbrowser 0x33c51:$s10: logins 0x3352a:$s11: credential 0x2ff0b:$g1: get_Clipboard 0x2ff19:$g2: get_Keyboard 0x2ff26:$g3: get_Password 0x3151a:$g4: get_CtrlKeyDown 0x3152a:$g5: get_ShiftKeyDown 0x3153b:$g6: get_AltKeyDown
4.0.e3.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.6.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.e3.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d38:$s1: get_kbok 0x3166c:$s2: get_CHoo 0x322c7:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x3526e:$s8: torbrowser 0x33c51:$s10: logins 0x3352a:$s11: credential 0x2ff0b:$g1: get_Clipboard 0x2ff19:$g2: get_Keyboard 0x2ff26:$g3: get_Password 0x3151a:$g4: get_CtrlKeyDown 0x3152a:$g5: get_ShiftKeyDown 0x3153b:$g6: get_AltKeyDown
0.2.e3.exe.6e10000.4.raw.unpack	MALWARE_Win_DLAgent05	Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable	ditekSHen	0x9430:$s1: MARCUS.dll 0x14e04:$s1: MARCUS.dll 0x14eb8:$s1: MARCUS.dll 0xa188:$s2: GZipStream 0xa17b:$s3: MemoryStream 0xa28d:$s4: proj_name 0xa284:$s5: res_name
0.2.e3.exe.3b82640.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.e3.exe.3b82640.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.e3.exe.3b82640.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2ef38:$s1: get_kbok 0x2f86c:$s2: get_CHoo 0x304c7:$s3: set_passwordIsSet 0x2ed23:$s4: get_enableLog 0x3346e:$s8: torbrowser 0x31e51:$s10: logins 0x3172a:$s11: credential 0x2e10b:$g1: get_Clipboard 0x2e119:$g2: get_Keyboard 0x2e126:$g3: get_Password 0x2f71a:$g4: get_CtrlKeyDown 0x2f72a:$g5: get_ShiftKeyDown 0x2f73b:$g6: get_AltKeyDown
0.2.e3.exe.7170000.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.e3.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.12.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.e3.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d38:$s1: get_kbok 0x3166c:$s2: get_CHoo 0x322c7:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x3526e:$s8: torbrowser 0x33c51:$s10: logins 0x3352a:$s11: credential 0x2ff0b:$g1: get_Clipboard 0x2ff19:$g2: get_Keyboard 0x2ff26:$g3: get_Password 0x3151a:$g4: get_CtrlKeyDown 0x3152a:$g5: get_ShiftKeyDown 0x3153b:$g6: get_AltKeyDown
0.2.e3.exe.3a0d710.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.e3.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.4.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.e3.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d38:$s1: get_kbok 0x3166c:$s2: get_CHoo 0x322c7:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x3526e:$s8: torbrowser 0x33c51:$s10: logins 0x3352a:$s11: credential 0x2ff0b:$g1: get_Clipboard 0x2ff19:$g2: get_Keyboard 0x2ff26:$g3: get_Password 0x3151a:$g4: get_CtrlKeyDown 0x3152a:$g5: get_ShiftKeyDown 0x3153b:$g6: get_AltKeyDown
4.0.e3.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.e3.exe.400000.10.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.0.e3.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d38:$s1: get_kbok 0x3166c:$s2: get_CHoo 0x322c7:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x3526e:$s8: torbrowser 0x33c51:$s10: logins 0x3352a:$s11: credential 0x2ff0b:$g1: get_Clipboard 0x2ff19:$g2: get_Keyboard 0x2ff26:$g3: get_Password 0x3151a:$g4: get_CtrlKeyDown 0x3152a:$g5: get_ShiftKeyDown 0x3153b:$g6: get_AltKeyDown
4.2.e3.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.e3.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.e3.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.e3.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d38:$s1: get_kbok 0x3166c:$s2: get_CHoo 0x322c7:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0x3526e:$s8: torbrowser 0x33c51:$s10: logins 0x3352a:$s11: credential 0x2ff0b:$g1: get_Clipboard 0x2ff19:$g2: get_Keyboard 0x2ff26:$g3: get_Password 0x3151a:$g4: get_CtrlKeyDown 0x3152a:$g5: get_ShiftKeyDown 0x3153b:$g6: get_AltKeyDown
0.2.e3.exe.3bb8860.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.e3.exe.3bb8860.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.e3.exe.3bb8860.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.e3.exe.3bb8860.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xb9f58:$s1: get_kbok 0xba88c:$s2: get_CHoo 0xbb4e7:$s3: set_passwordIsSet 0xb9d43:$s4: get_enableLog 0xbe48e:$s8: torbrowser 0xbce71:$s10: logins 0xbc74a:$s11: credential 0xb912b:$g1: get_Clipboard 0xb9139:$g2: get_Keyboard 0xb9146:$g3: get_Password 0xba73a:$g4: get_CtrlKeyDown 0xba74a:$g5: get_ShiftKeyDown 0xba75b:$g6: get_AltKeyDown
0.2.e3.exe.3b82640.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.e3.exe.3b82640.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.e3.exe.3b82640.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.e3.exe.3b82640.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d38:$s1: get_kbok 0xf0178:$s1: get_kbok 0x3166c:$s2: get_CHoo 0xf0aac:$s2: get_CHoo 0x322c7:$s3: set_passwordIsSet 0xf1707:$s3: set_passwordIsSet 0x30b23:$s4: get_enableLog 0xeff63:$s4: get_enableLog 0x3526e:$s8: torbrowser 0xf46ae:$s8: torbrowser 0x33c51:$s10: logins 0xf3091:$s10: logins 0x3352a:$s11: credential 0xf296a:$s11: credential 0x2ff0b:$g1: get_Clipboard 0xef34b:$g1: get_Clipboard 0x2ff19:$g2: get_Keyboard 0xef359:$g2: get_Keyboard 0x2ff26:$g3: get_Password 0xef366:$g3: get_Password 0x3151a:$g4: get_CtrlKeyDown
Click to see the 34 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.0.e3.exe.400000.8.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Chat id": "1299507057", "Chat URL": "https://api.telegram.org/bot1341301202:AAHzCj-Eu3mWY1PQc6gP-IXoYKSfMPo3X2w/sendDocument"}
Source: e3.exe.6540.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot1341301202:AAHzCj-Eu3mWY1PQc6gP-IXoYKSfMPo3X2w/sendMessage"}

Multi AV Scanner detection for submitted file

Source: e3.exe	Virustotal: Detection: 70%			Perma Link
Source: e3.exe	ReversingLabs: Detection: 73%

Antivirus / Scanner detection for submitted sample

Source: e3.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\PhOyTxcSdzas.exe

Avira: detection malicious, Label: HEUR/AGEN.1202709

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\PhOyTxcSdzas.exe

ReversingLabs: Detection: 73%

Machine Learning detection for sample

Source: e3.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\PhOyTxcSdzas.exe

Joe Sandbox ML: detected

Source: 4.0.e3.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.e3.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.e3.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.e3.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.e3.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.e3.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Source: e3.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown<

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
e3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Windows Analysis Report
e3.exe