MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5dbf48fc0a54983e93136e5ae2da34f6d525c96c13a9ab8e16f30c81935bec71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	5dbf48fc0a54983e93136e5ae2da34f6d525c96c13a9ab8e16f30c81935bec71
SHA3-384 hash:	55347ab3bfe1770bac308c79618010f22a758e91a74cd98a62912975a254c91c797efbfc0bc841afb16dccedfcb028d0
SHA1 hash:	ad505e3865f83eda9f2dc80148f32975552825cc
MD5 hash:	a69453d347914f67b10f9d38639dbecc
humanhash:	pennsylvania-foxtrot-skylark-eleven
File name:	noni B.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	834'048 bytes
First seen:	2021-06-02 06:15:59 UTC
Last seen:	2021-06-02 07:04:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep	12288:k1VvTztqYGLqejVj9W/QUu4n73xtj1lzm4BpOsZNH50aOjrOBbaJOkl:k13EVjVITBZi6pHZDzOjS
Threatray	11'146 similar samples on MalwareBazaar
TLSH	41057CF8F5A8A8B1C54ECB72C7919CAEEB1112FE5203492C06B9DA8C1F0379E9F5D445
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

noni B.exe

Verdict:

No threats detected

Analysis date:

2021-06-02 06:19:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ac77dc61-6d3e-49f9-abbf-6a3ddb4ed4ab

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/163927/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.27026.4049.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/795640

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Allocates memory in foreign processes

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Sigma detected: Suspicious Process Start Without DLL

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/5dbf48fc0a54983e93136e5ae2da34f6d525c96c13a9ab8e16f30c81935bec71/

Threat name:

ByteCode-MSIL.Trojan.Taskun

Status:

Malicious

First seen:

2021-06-02 06:16:12 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

11 of 46 (23.91%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lw7ur7akksmd5eytnznofwru63kslslmcou2xdqw6mgide235ryq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5a1ff51485fd7f49e413093ab5c705265a6d5ec108c1ce955fbe99da3d29aa33

AgentTesla

6824c4afb5e56e0c2b3e0b89a4acde70bcc2bd792334a6600225e623162ae621

AgentTesla

73227e5663576f946ecdd31082bd8ccbd65cb8332f3ccff9807d43c2481276aa

AgentTesla

8c56d142eb23fdea3f843ca98489eaf220c7836af64f19a49c8ab332918cc87f

AgentTesla

90ffadcff25b2faecd4cccabac3af9f5329aea12e3330aa408545408bd482fce

AgentTesla

94fcc8c7fd53c5463c0d33d1f74b5c7c8c0ae95ef097477958acb9df1ae5a15e

AgentTesla

9fb6d87571d0969f22ef14f6d999126e4307415de7a7e92fc7e773cdc7549494

AgentTesla

a596fdfb8997f081dd7674b248d02518f1052fe4b1c384a050f6a82b65816311

AgentTesla

c3196a4d4498a77b2e27353a3cd61ce5494bdce1f29f5643e8fece30aba5a20e

AgentTesla

+ 11'136 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210602-71jsaj1zmx/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5dbf48fc0a54983e93136e5ae2da34f6d525c96c13a9ab8e16f30c81935bec71

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.