MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bafe48bb81775d723528b1d0604dd8cc754117e4f8a23bf5e4c589d00bc1dd0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bafe48bb81775d723528b1d0604dd8cc754117e4f8a23bf5e4c589d00bc1dd0d
SHA3-384 hash: 339666ab1456e6f80facad6c78c21b229eb04ed329bc7f63a4af32e2bce37bbcac7117ccfe089a5b0a0dcdcee04e7dd1
SHA1 hash: a5171310d0a4524f2f9bd84a4e04e35acd3894db
MD5 hash: 8b69115d1abcf1379c5047f8e408f359
humanhash: jupiter-finch-georgia-illinois
File name:pidgin-otr-4.0.2.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:13'621'760 bytes
First seen:2023-10-11 22:07:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 196608:CqYvmaThVTWNty+8Pw54kqhkOxvJ9t1nPMtjxAHvLEd5VJK:Cq6ma9VyNow5skiffn0ZxAE
Threatray 54 similar samples on MalwareBazaar
TLSH T1AFD63329461C9CB8DE13103C06614B6492BFEFD2515BEBE609EA3746C7269131CABC7F
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 45597173762404cc (1 x Loki, 1 x AgentTesla, 1 x ACRStealer)
Reporter vovaan
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
313
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
pidgin-otr-4.0.2.exe
Verdict:
Malicious activity
Analysis date:
2023-10-11 21:59:22 UTC
Tags:
agenttesla stealer evasion
Link:
https://app.any.run/tasks/b7b53eb4-2df9-4b68-9857-b10d45702602

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1560.904.3723.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Creating a window
Sending a custom TCP request
Searching for synchronization primitives
DNS request
Unauthorized injection to a recently created process
Gathering data
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/bafe48bb81775d723528b1d0604dd8cc754117e4f8a23bf5e4c589d00bc1dd0d
Result
Verdict:
MALICIOUS
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d589b237-3c96-4200-8f59-08cbbb21bd13
Result
Threat name:
Agent Tesla, AgentTesla, DanaBot, SmokeL
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1324211
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to capture screen (.Net source)
Creates a thread in another existing process (thread injection)
Detected Agent Tesla keylogger
Detected unpacking (changes PE section rights)
Found API chain indicative of debugger detection
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May use the Tor software to hide its network traffic
Query firmware table information (likely to detect VMs)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected DanaBot stealer dll
Yara detected Generic Downloader
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1324211 Sample: pidgin-otr-4.0.2.exe Startdate: 12/10/2023 Architecture: WINDOWS Score: 100 74 wirtshauspost.at 2->74 76 checkip.dyndns.org 2->76 78 4 other IPs or domains 2->78 98 Found malware configuration 2->98 100 Malicious sample detected (through community Yara rule) 2->100 102 Antivirus detection for URL or domain 2->102 104 10 other signatures 2->104 11 pidgin-otr-4.0.2.exe 2 2->11         started        15 Update.exe 14 18 2->15         started        17 gjfcsjh 2->17         started        19 2 other processes 2->19 signatures3 process4 file5 72 C:\Users\user\AppData\Local\...\hGvZYMT.exe, PE32 11->72 dropped 134 Injects a PE file into a foreign processes 11->134 21 hGvZYMT.exe 17 22 11->21         started        26 pidgin-otr-4.0.2.exe 3 11->26         started        136 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->136 138 Tries to steal Instant Messenger accounts or passwords 15->138 140 Tries to steal Mail credentials (via file / registry access) 15->140 150 4 other signatures 15->150 28 Update.exe 15->28         started        142 Antivirus detection for dropped file 17->142 144 Detected unpacking (changes PE section rights) 17->144 146 Machine Learning detection for dropped file 17->146 152 4 other signatures 17->152 148 Query firmware table information (likely to detect VMs) 19->148 signatures6 process7 dnsIp8 88 132.226.8.169, 49712, 49720, 80 UTMEMUS United States 21->88 90 alayyadcare.com 213.6.54.58, 443, 49717, 49737 PALTEL-ASPALTELAutonomousSystemPS Palestinian Territory Occupied 21->90 92 2 other IPs or domains 21->92 58 C:\Users\user\AppData\Roaming\...\Update.exe, PE32 21->58 dropped 60 C:\Users\user\AppData\...\tmpG38.tmp (copy), PE32 21->60 dropped 62 C:\Users\user\AppData\Local\Temp\Update.exe, PE32 21->62 dropped 108 Antivirus detection for dropped file 21->108 110 Detected Agent Tesla keylogger 21->110 112 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->112 122 5 other signatures 21->122 30 Update.exe 21->30         started        33 dw20.exe 21->33         started        35 WerFault.exe 21->35         started        114 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 28->114 116 Maps a DLL or memory area into another process 28->116 118 Checks if the current machine is a virtual machine (disk enumeration) 28->118 120 Creates a thread in another existing process (thread injection) 28->120 file9 signatures10 process11 signatures12 154 Antivirus detection for dropped file 30->154 156 Detected unpacking (changes PE section rights) 30->156 158 Machine Learning detection for dropped file 30->158 160 4 other signatures 30->160 37 explorer.exe 30->37 injected process13 dnsIp14 94 wirtshauspost.at 211.171.233.129, 49722, 49723, 49724 LGDACOMLGDACOMCorporationKR Korea Republic of 37->94 96 5.226.141.207, 49759, 80 BANDWIDTH-ASGB United Kingdom 37->96 64 C:\Users\user\AppData\Roaming\gjfcsjh, PE32 37->64 dropped 66 C:\Users\user\AppData\Local\Temp\85BA.exe, PE32 37->66 dropped 68 C:\Users\user\AppData\Local\Temp\4881.exe, PE32 37->68 dropped 124 System process connects to network (likely due to code injection or exploit) 37->124 126 Benign windows process drops PE files 37->126 128 Hides that the sample has been downloaded from the Internet (zone.identifier) 37->128 42 4881.exe 37->42         started        46 85BA.exe 37->46         started        48 Update.exe 37->48         started        50 2 other processes 37->50 file15 signatures16 process17 file18 70 C:\ProgramData\Qdsypeqeoasuop.tmp, DOS 42->70 dropped 130 Found API chain indicative of debugger detection 42->130 132 May use the Tor software to hide its network traffic 42->132 52 rundll32.exe 42->52         started        56 rundll32.exe 46->56         started        signatures19 process20 dnsIp21 80 185.4.65.42, 443, 49787 RECONNRU United Kingdom 52->80 82 45.136.49.68, 443, 49788 PELUCHE-ASES Estonia 52->82 84 37.59.205.1, 443, 49786, 49789 OVHFR France 52->84 106 System process connects to network (likely due to code injection or exploit) 52->106 86 127.0.0.1 unknown unknown 56->86 signatures22
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bafe48bb81775d723528b1d0604dd8cc754117e4f8a23bf5e4c589d00bc1dd0d/
Threat name:
ByteCode-MSIL.Trojan.ZulsyCrypt
Create hunting rule
Status:
Malicious
First seen:
2023-10-11 22:08:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xl7ero4bo5oxenjiwhigatoyzr2ucf7e7crdx5peywe5ac6b3ugq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c70db6a9ca76b810f83954cfd531c69d437484d7346c11cb8234e600a1fa2c3
AgentTesla
1be4551aa3f6e1c1e3ca71c9de748778f2280e45225c9abc439c79d6bb40919c
AgentTesla
4b145824b7d8925df8648316b35a8270a236517b0bbe23c879205901fb1af8ca
AgentTesla
4eda7fdcc6081486e3a840365c46e5d069fb5c521b9eecad775456fea48c9ab3
AgentTesla
5498127f11928bb91062949e7f2d2a140164036490563db5fcfb85c29e4d3e1f
AgentTesla
6f7ca91ba97ef5763da989b082f5f48168ecd080d20867e90194759c5516f2c5
AgentTesla
89d8498d9a82a1505396158092d7ea645c2b9097b959a4b1095983d2f01be959
AgentTesla
8d838d8dfcbba6f068d455c39821bff5e4fa44008adb85a54106ac06f6382dfb
AgentTesla
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection persistence spyware stealer
Link:
https://tria.ge/reports/231011-11774sfc41/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
461cce253e30a2786c8205b3bde348d892829b3b4c8b18981c9276bae290adc0
MD5 hash:
f27daca22dfe87b329e2c7a21d0ab3ae
SHA1 hash:
e2ccac03b942a739a5c912cde9324f3058c71f89
Link:
https://www.unpac.me/results/b2c0b5d3-dbee-4d09-a650-82d621c58c04/
SH256 hash:
7a40f9d09f0970e6d699ae21c59bd7a120d2dd323b96758b8564a318bc58f019
MD5 hash:
abccaa926c69ad423597e4cf47c6cfd3
SHA1 hash:
c10c33bd17fa18802c387a6047dc338b29318964
Detections:
win_agent_tesla_g1
Create hunting rule
Link:
https://www.unpac.me/results/b2c0b5d3-dbee-4d09-a650-82d621c58c04/
Parent samples :
bafe48bb81775d723528b1d0604dd8cc754117e4f8a23bf5e4c589d00bc1dd0d
f846f943ac950b4e9e64ad399f99c6d3a51643b9f5fe572fbb7fe90dde32e9ca
SH256 hash:
d55800a825792f55999abdad199dfa54f3184417215a298910f2c12cd9cc31ee
MD5 hash:
bfb160a89f4a607a60464631ed3ed9fd
SHA1 hash:
1c981ef3eea8548a30e8d7bf8d0d61f9224288dd
Link:
https://www.unpac.me/results/b2c0b5d3-dbee-4d09-a650-82d621c58c04/
SH256 hash:
bafe48bb81775d723528b1d0604dd8cc754117e4f8a23bf5e4c589d00bc1dd0d
MD5 hash:
8b69115d1abcf1379c5047f8e408f359
SHA1 hash:
a5171310d0a4524f2f9bd84a4e04e35acd3894db
Link:
https://www.unpac.me/results/b2c0b5d3-dbee-4d09-a650-82d621c58c04/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bafe48bb8177/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bafe48bb81775d723528b1d0604dd8cc754117e4f8a23bf5e4c589d00bc1dd0d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla
Create hunting rule
Author:kevoreilly
Description:AgentTesla Payload
Rule name:AgentTeslaV2
Create hunting rule
Author:ditekshen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:AgentTesla_mod_tough_mem
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:agent_tesla
Create hunting rule
Author:Stormshield
Description:Detecting HTML strings used by Agent Tesla malware
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments