MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635
SHA3-384 hash: 1149298cd472a192a06cc96e18a4377ee30dd7eade39387a83e7f903599feb3ec5b51e175dca472ca90d297280c809ab
SHA1 hash: f1fd8ceb0c33d51d36e7b48fe2672ee1873a8d5c
MD5 hash: e959a251d4fd9d7c2bb495120b34e0c7
humanhash: snake-idaho-single-hamper
File name:Hitomi Downloader.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:10'173'568 bytes
First seen:2024-04-01 11:19:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'070 x AgentTesla, 20'021 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 3072:g2YHCLwn3UjOikH+LGP34o7KerVUzeeDXbwa21Dv9ua/aHyvDTd2iWtxILgcaL1K:g2YHuwn3UFdbwvsvj3xh
Threatray 121 similar samples on MalwareBazaar
TLSH T10DA60911EFA844A6DEED6A3080B1650D6F3BBD60481397C94FC275AD2A33D4191DBBB3
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon ceb361c4dc49b36f (1 x AgentTesla)
Reporter Anonymous
Tags:AgentTesla exe


Avatar
Anonymous
ip 173.201.180.75

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635.exe
Verdict:
Malicious activity
Analysis date:
2024-04-01 13:39:23 UTC
Tags:
evasion agenttesla stealer
Link:
https://app.any.run/tasks/912f601e-fe22-41d4-9ac7-76fe7d4d360a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Creating a window
Sending a TCP request to an infection source
Reading critical registry keys
Sending an HTTP GET request to an infection source
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Moving a file to the Program Files subdirectory
Replacing files
Query of malicious DNS domain
Connection attempt to an infection source
Moving of the original file
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
82%
Tags:
anti-vm cmd crypto fingerprint infostealer keylogger lolbin msconfig netsh overlay packed shell32 stealer stealer
Link:
https://www.filescan.io/uploads/660a9864bb285b5db053c50c/reports/c76bfbd7-cc06-44c0-a977-f575d9a9214f/overview
Verdict:
Malicious
Labled as:
MSIL.PasswordStealerA.Generic
Link:
https://www.hybrid-analysis.com/sample/2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/887edfe5-5568-497f-8764-bcc3154adaba
Result
Threat name:
Agent Tesla, AgentTesla, RisePro Stealer
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1418093
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to capture screen (.Net source)
Detected Agent Tesla keylogger
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Moves itself to temp directory
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Uses known network protocols on non-standard ports
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected RisePro Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1418093 Sample: Hitomi Downloader.exe Startdate: 01/04/2024 Architecture: WINDOWS Score: 100 25 rakishevkenes.com 2->25 27 checkip.dyndns.org 2->27 29 3 other IPs or domains 2->29 41 Snort IDS alert for network traffic 2->41 43 Multi AV Scanner detection for domain / URL 2->43 45 Found malware configuration 2->45 47 12 other signatures 2->47 7 Hitomi Downloader.exe 16 20 2->7         started        signatures3 process4 dnsIp5 31 193.233.132.108, 49740, 8081 FREE-NET-ASFREEnetEU Russian Federation 7->31 33 rakishevkenes.com 173.201.180.75, 443, 49737, 49739 AS-26496-GO-DADDY-COM-LLCUS United States 7->33 35 checkip.dyndns.com 158.101.44.242, 49736, 80 ORACLE-BMC-31898US United States 7->35 21 C:\Users\user\AppData\Local\Temp\Update.exe, PE32 7->21 dropped 49 Detected Agent Tesla keylogger 7->49 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 7->51 53 Moves itself to temp directory 7->53 55 5 other signatures 7->55 12 Update.exe 58 7->12         started        17 dw20.exe 2 12 7->17         started        19 WerFault.exe 2 7->19         started        file6 signatures7 process8 dnsIp9 37 ipinfo.io 34.117.186.192 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 12->37 39 db-ip.com 104.26.5.15 CLOUDFLARENETUS United States 12->39 23 C:\Users\user\...\d5lqTQks_pG2dGAy_G7A1bs.zip, Zip 12->23 dropped 57 Multi AV Scanner detection for dropped file 12->57 59 Detected unpacking (creates a PE file in dynamic memory) 12->59 61 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 12->61 63 6 other signatures 12->63 file10 signatures11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2024-04-01 11:21:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
22
AV detection:
24 of 24 (100.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnn7oxak5xqrnht2uk2moyfrquxtjginlogoe7fc7iq67i26ay2q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1be4551aa3f6e1c1e3ca71c9de748778f2280e45225c9abc439c79d6bb40919c
AgentTesla
276198e30803db7e1c567868cb302237b8a95b16fa2fb4e1ab607d880cf73ef4
AgentTesla
4023d96589970420857763ffa1f1fd0eb79668344e095f9e81f851e479e776cc
AgentTesla
4b145824b7d8925df8648316b35a8270a236517b0bbe23c879205901fb1af8ca
AgentTesla
53b8393fbbce738427c91ba6d5f16f8a98a63d943dd96470ae3d83cf80f4ac21
AgentTesla
bd074f64fe0b208116d827e0b207c160caf59e268b8e8dc746a3a3de1dd32201
AgentTesla
d4fa689830e2d0b86a0035e3ef91ffa5957470e3c8f5bbbe815fee41fc83f2a2
AgentTesla
d85a9526b3eb9c38f7f5dc77ec40c9778e19939bfda294d25a365a743c4a5434
AgentTesla
dce7e736ce81d68584906eca24707654e9610fb57a04893a0688351347401838
AgentTesla
+ 111 additional samples on MalwareBazaar
Result
Malware family:
risepro
Create hunting rule
Score:
  10/10
Tags:
family:risepro collection spyware stealer
Link:
https://tria.ge/reports/240401-nfenvada2t/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Enumerates physical storage devices
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
RisePro
Unpacked files
SH256 hash:
d55800a825792f55999abdad199dfa54f3184417215a298910f2c12cd9cc31ee
MD5 hash:
bfb160a89f4a607a60464631ed3ed9fd
SHA1 hash:
1c981ef3eea8548a30e8d7bf8d0d61f9224288dd
Link:
https://www.unpac.me/results/671d267e-be87-460f-bfc9-5e1112101c29/
SH256 hash:
2601666186f980cc33c5cb309fec1351502d02d54bc5ffa0a975776f58a7d6ea
MD5 hash:
849d5e4645e61d26ecc9a77e58681f20
SHA1 hash:
4a9361c8e21b7473249bdc669ef087dbc6bf823f
Link:
https://www.unpac.me/results/671d267e-be87-460f-bfc9-5e1112101c29/
SH256 hash:
2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635
MD5 hash:
e959a251d4fd9d7c2bb495120b34e0c7
SHA1 hash:
f1fd8ceb0c33d51d36e7b48fe2672ee1873a8d5c
Detections:
win_agent_tesla_g1
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
MALWARE_Win_AgentTeslaV3
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/671d267e-be87-460f-bfc9-5e1112101c29/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2b5bf75c0aed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla
Create hunting rule
Author:kevoreilly
Description:AgentTesla Payload
Rule name:AgentTeslaV2
Create hunting rule
Author:ditekshen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:AgentTesla_mod_tough_mem
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:agent_tesla
Create hunting rule
Author:Stormshield
Description:Detecting HTML strings used by Agent Tesla malware
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments