File name:

efbadf6608789bb0cf7196978b4d71df.exe

Full analysis: https://app.any.run/tasks/cbb5b2f3-f62e-4dfe-a82e-1038fedfe1c1
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 16:59:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
stealer
agenttesla
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

EFBADF6608789BB0CF7196978B4D71DF

SHA1:

CAFD7CD91642A2753F8A1C50A9260CD24EC6D280

SHA256:

BBD571C10577D25DCDB8B4302D9E2CD872D824FB6DF542997FC4819BBCE147B6

SSDEEP:

24576:aRJNf3Z1wCpUlLWi1l+BcBnrnoEjjk3b3abg8+QBMQanwtZwZAJDS0W7OOYf:aRJNfp1wCpUlLWi1l+BcBrnoEjjk3b3q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AGENTTESLA has been detected (YARA)

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

    • Steals credentials from Web Browsers

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

    • Actions looks like stealing of personal data

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

  • SUSPICIOUS

    • Reads browser cookies

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

    • Reads settings of System Certificates

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

    • Connects to SMTP port

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

    • Application launched itself

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 2540)

    • Accesses Microsoft Outlook profiles

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

    • Adds/modifies Windows certificates

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

  • INFO

    • Checks supported languages

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 2540)
      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

    • Reads the computer name

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 2540)
      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)

    • Reads the machine GUID from the registry

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)
      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 2540)

    • Reads Environment values

      • efbadf6608789bb0cf7196978b4d71df.exe (PID: 796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(796) efbadf6608789bb0cf7196978b4d71df.exe
Protocolsmtp
Hostcp5ua.hyperhost.ua
Port587
Usernameobilog@hulkeng.xyz
Password7213575aceACE@#$
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:01 04:09:32+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 689152
InitializedDataSize: 11776
UninitializedDataSize: -
EntryPoint: 0xaa3ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.4.3.2
ProductVersionNumber: 4.4.3.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Linq DB
CompanyName: CSULB
FileDescription: LinqDB
FileVersion: 4.4.3.2
InternalName: Onjp.exe
LegalCopyright: 2023 © CSULB
LegalTrademarks: -
OriginalFileName: Onjp.exe
ProductName: Linq DB
ProductVersion: 4.4.3.2
AssemblyVersion: 4.4.3.3
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start efbadf6608789bb0cf7196978b4d71df.exe no specs #AGENTTESLA efbadf6608789bb0cf7196978b4d71df.exe

Process information

PID
CMD
Path
Indicators
Parent process
796"C:\Users\admin\AppData\Local\Temp\efbadf6608789bb0cf7196978b4d71df.exe"C:\Users\admin\AppData\Local\Temp\efbadf6608789bb0cf7196978b4d71df.exe
efbadf6608789bb0cf7196978b4d71df.exe
User:
admin
Company:
CSULB
Integrity Level:
MEDIUM
Description:
LinqDB
Exit code:
0
Version:
4.4.3.2
Modules
Images
c:\users\admin\appdata\local\temp\efbadf6608789bb0cf7196978b4d71df.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
AgentTesla
(PID) Process(796) efbadf6608789bb0cf7196978b4d71df.exe
Protocolsmtp
Hostcp5ua.hyperhost.ua
Port587
Usernameobilog@hulkeng.xyz
Password7213575aceACE@#$
2540"C:\Users\admin\AppData\Local\Temp\efbadf6608789bb0cf7196978b4d71df.exe" C:\Users\admin\AppData\Local\Temp\efbadf6608789bb0cf7196978b4d71df.exe—explorer.exe
User:
admin
Company:
CSULB
Integrity Level:
MEDIUM
Description:
LinqDB
Exit code:
0
Version:
4.4.3.2
Modules
Images
c:\users\admin\appdata\local\temp\efbadf6608789bb0cf7196978b4d71df.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
Total events
881
Read events
870
Write events
9
Delete events
2

Modification events

(PID) Process:(796) efbadf6608789bb0cf7196978b4d71df.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(796) efbadf6608789bb0cf7196978b4d71df.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Operation:writeName:Blob
Value:
1900000001000000100000002AA1C05E2AE606F198C2C5E937C97AA2030000000100000014000000D1EB23A46D17D68FD92564C2F1F1601764D8E3491D00000001000000100000002E0D6875874A44C820912E85E964CFDB140000000100000014000000A0110A233E96F107ECE2AF29EF82A57FD030A4B40B000000010000001C0000005300650063007400690067006F002000280041004100410029000000620000000100000020000000D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF453000000010000004300000030413022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0301B060567810C010330123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030206082B06010505070303060A2B0601040182370A030406082B0601050507030406082B0601050507030606082B0601050507030706082B0601050507030106082B060105050703080F00000001000000140000003E8E6487F8FD27D322A269A71EDAAC5D57811286200000000100000036040000308204323082031AA003020102020101300D06092A864886F70D0101050500307B310B3009060355040613024742311B301906035504080C1247726561746572204D616E636865737465723110300E06035504070C0753616C666F7264311A3018060355040A0C11436F6D6F646F204341204C696D697465643121301F06035504030C18414141204365727469666963617465205365727669636573301E170D3034303130313030303030305A170D3238313233313233353935395A307B310B3009060355040613024742311B301906035504080C1247726561746572204D616E636865737465723110300E06035504070C0753616C666F7264311A3018060355040A0C11436F6D6F646F204341204C696D697465643121301F06035504030C1841414120436572746966696361746520536572766963657330820122300D06092A864886F70D01010105000382010F003082010A0282010100BE409DF46EE1EA76871C4D45448EBE46C883069DC12AFE181F8EE402FAF3AB5D508A16310B9A06D0C57022CD492D5463CCB66E68460B53EACB4C24C0BC724EEAF115AEF4549A120AC37AB23360E2DA8955F32258F3DEDCCFEF8386A28C944F9F68F29890468427C776BFE3CC352C8B5E07646582C048B0A891F9619F762050A891C766B5EB78620356F08A1A13EA31A31EA099FD38F6F62732586F07F56BB8FB142BAFB7AACCD6635F738CDA0599A838A8CB17783651ACE99EF4783A8DCF0FD942E2980CAB2F9F0E01DEEF9F9949F12DDFAC744D1B98B547C5E529D1F99018C7629CBE83C7267B3E8A25C7C0DD9DE6356810209D8FD8DED2C3849C0D5EE82FC90203010001A381C03081BD301D0603551D0E04160414A0110A233E96F107ECE2AF29EF82A57FD030A4B4300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF307B0603551D1F047430723038A036A0348632687474703A2F2F63726C2E636F6D6F646F63612E636F6D2F414141436572746966696361746553657276696365732E63726C3036A034A0328630687474703A2F2F63726C2E636F6D6F646F2E6E65742F414141436572746966696361746553657276696365732E63726C300D06092A864886F70D010105050003820101000856FC02F09BE8FFA4FAD67BC64480CE4FC4C5F60058CCA6B6BC1449680476E8E6EE5DEC020F60D68D50184F264E01E3E6B0A5EEBFBC745441BFFDFC12B8C74F5AF48960057F60B7054AF3F6F1C2BFC4B97486B62D7D6BCCD2F346DD2FC6E06AC3C334032C7D96DD5AC20EA70A99C1058BAB0C2FF35C3ACF6C37550987DE53406C58EFFCB6AB656E04F61BDC3CE05A15C69ED9F15948302165036CECE92173EC9B03A1E037ADA015188FFABA02CEA72CA910132CD4E50826AB229760F8905E74D4A29A53BDF2A968E0A26EC2D76CB1A30F9EBFEB68E756F2AEF2E32B383A0981B56B85D7BE2DED3F1AB7B263E2F5622C82D46A004150F139839F95E93696986E
(PID) Process:(796) efbadf6608789bb0cf7196978b4d71df.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
796
efbadf6608789bb0cf7196978b4d71df.exe
91.235.128.141:587
cp5ua.hyperhost.ua
ITL LLC
UA
unknown

DNS requests

Domain
IP
Reputation
cp5ua.hyperhost.ua
  • 91.235.128.141
malicious

Threats

PID
Process
Class
Message
796
efbadf6608789bb0cf7196978b4d71df.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
796
efbadf6608789bb0cf7196978b4d71df.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via SMTP
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
efbadf6608789bb0cf7196978b4d71df.exe