MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b80b9d58bb6b3f95abaab07a58e5fbab1d070a3a0c0df2f67ac628c9f7be058. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	1b80b9d58bb6b3f95abaab07a58e5fbab1d070a3a0c0df2f67ac628c9f7be058
SHA3-384 hash:	539e3af89568116a54a701934cc3fd1df5aad03c79b8bc530f39fb34f62f2ef88f905997b7500d8d98b6fcf79aa661d6
SHA1 hash:	e1e7198b8b7669abfa8f7fb58ba1f6833f5ffbc3
MD5 hash:	a36881112d9b6cb8abb0ff8fb3c3dbf4
humanhash:	magnesium-mango-carpet-lima
File name:	Purchase Order 11013.iso
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	157'696 bytes
First seen:	2023-06-09 09:28:24 UTC
Last seen:	2023-06-09 09:28:39 UTC
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	768:BNLE6ewSRmSTY94dWN2P7b1IzPrXMkN336DX2AAV:LE6ewSDY94du2PmfMkN3KDmAAV
TLSH	T1CBF373D3B21288D6F93847719D23C98915A7FDADB8B4156EB09EB7780B773830412B36
TrID	99.5% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter	cocaman
Tags:	AgentTesla iso

cocaman

Malicious email (T1566.001)
From: "Paulus Eko Suryadi <paulus.eko.suryadi@id.astariglobal.com>" (likely spoofed)
Received: "from id.astariglobal.com (unknown [141.98.6.214]) "
Date: "7 Jun 2023 20:15:56 +0200"
Subject: "RE: Purchase Order 11013"
Attachment: "Purchase Order 11013.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

110

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Purchase Order 11013.exe
File size:	105'472 bytes
SHA256 hash:	44700efabdbbe386e2e689d0de94da92133cd2c36effe104ea5e8dc81a87fa5c
MD5 hash:	aec8743883c8342e2836d89cd38f7294
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Iso_fs1146.UNOFFICIAL

SecuriteInfo.com.Variant.MSILHeracles.84860.7185.18259.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

context-iso packed

Link:

https://www.filescan.io/uploads/6482f0de3d73a4d71709d8c6/reports/0fb5c4b3-b1ba-4073-9367-20003d5ca20e/overview

Verdict:

Malicious

Labled as:

MSIL_Agent.FLP.gen

Link:

https://www.hybrid-analysis.com/sample/1b80b9d58bb6b3f95abaab07a58e5fbab1d070a3a0c0df2f67ac628c9f7be058

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b80b9d58bb6b3f95abaab07a58e5fbab1d070a3a0c0df2f67ac628c9f7be058/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-06-07 09:33:27 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 37 (45.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=doaltvmlw2z7swv2vmd2lds7xky5a4fdudan6l3hvrrizh334bma._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230609-mz5hyacg3s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot6171107032:AAGnuLkWapUakrcrpegbgibDbN3r0phVBG4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1b80b9d58bb6b3f95abaab07a58e5fbab1d070a3a0c0df2f67ac628c9f7be058

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research