MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50737e711d6a55fe1c6e2289526e2d970a263ab033d93015b52a9fd2e3c5df58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	50737e711d6a55fe1c6e2289526e2d970a263ab033d93015b52a9fd2e3c5df58
SHA3-384 hash:	cb1b2491947b794038150f8708835653c6cb8e4c69eb51c897a97278a127573fd753cc1cd4cd0710f702c6ccdca4d9f1
SHA1 hash:	10490c57188974be28dc163ca1c0746067fe2db2
MD5 hash:	c957c06a93f88b30a209708e7a6cea2f
humanhash:	virginia-hotel-jersey-kitten
File name:	RFQ-1324455663 API 5L X 60.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	31'744 bytes
First seen:	2020-11-12 07:11:36 UTC
Last seen:	2024-07-24 14:12:27 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	768:FpkK7333Jl3Lu9uz09Ev/P1OK1a6Zg3CCuc:FWYbzI9EvX1OK1a6Euc
Threatray	1'118 similar samples on MalwareBazaar
TLSH	AAE2A440F580C895E07D923A8872D5600773FED69120D91B6EDA79AB7DB33431866E8F
Reporter	GovCERT_CH
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Generic.nm.11092.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a process with a hidden window

Sending a UDP request

DNS request

Unauthorized injection to a recently created process

Adding an access-denied ACE

Creating a window

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

Sending a TCP request to an infection source

Result

Gathering data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/532001

Signature

.NET source code contains very large array initializations

Connects to a pastebin service (likely for C&C)

Contains functionality to hide a thread from the debugger

Found malware configuration

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/50737e711d6a55fe1c6e2289526e2d970a263ab033d93015b52a9fd2e3c5df58/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-11-11 23:33:45 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kbzx44i5njk74hdoekeve3rns4fcmovqgpmtafnvfkp5fy6f35ma._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

31705dc52cd25b1a406341a071401d39833225a184c0918214edf72cd3a77a57

AgentTesla

320cad5692bb7d085732786b1823aac9c24aed4a2d1132763d3541f90380708e

AgentTesla

428b4819734a979d5685b235d190ab9e07bfd6e5098e22ee9195cd386dc701d0

AgentTesla

5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c

AgentTesla

639aa73ed2700349b87c9a12879447b219dfd137f60f50611588e9ced7726392

AgentTesla

89a79d6e08f22036f754947d43d1c5b6ba7865e246f462dedea0836dd748a8ea

AgentTesla

e064cd70ae6467ad9c0342b4750cae4fb688c56b0d904ea4091aa074e174dcf0

AgentTesla

e788686b2a0e0efbf94e3f33a47e63494ca216e965191d82cd2922b8af6fe037

AgentTesla

f18cad860921a0bc03d702f1b55cd15568fef0ee674fe2124ecdcbd10ebd82d2

AgentTesla

+ 1'108 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/201112-q245kmkmza/

Behaviour

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

50737e711d6a55fe1c6e2289526e2d970a263ab033d93015b52a9fd2e3c5df58

MD5 hash:

c957c06a93f88b30a209708e7a6cea2f

SHA1 hash:

10490c57188974be28dc163ca1c0746067fe2db2

Link:

https://www.unpac.me/results/9b7c902b-01f4-49ba-ad23-6d94b6dd7d11/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.