MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c1bf399afbb2128937979f0a500979d511b8b90833869d400ad7119654b1305. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 10

Intelligence 10 IOCs YARA 15 File information Comments

SHA256 hash:	1c1bf399afbb2128937979f0a500979d511b8b90833869d400ad7119654b1305
SHA3-384 hash:	a9758adbf4e812c5e9f144c9c09b9d792a30a69d5b8d14ca13a44b4766bdc676a4aa96cdd964ae88366b8649d0e7f2a3
SHA1 hash:	8fbe943006fc04b42507140ff05a00db9ab5d249
MD5 hash:	1fc2c4fa14999023ae8468be636e802f
humanhash:	kentucky-social-grey-yellow
File name:	PO2502170014.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	629'981 bytes
First seen:	2025-06-19 08:34:18 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:T8xJQCqvLyCbDkYaJlI9IYo+UP1kahTm3NdEqdGE/o6tIDbiQ9WsTkwo0b:YqvZPsll1k6m3rw6sAwoK
TLSH	T175D423345F280BBFBB2138C5733FD0D1B249BA327CCA9E849591C48B56990E657893F5
Magika	zip
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: "Pur03 <pur03@rich-long.cn>" (likely spoofed)
Received: "from rich-long.cn (216-131-112-239.ams.as62651.net [216.131.112.239]) "
Date: "18 Jun 2025 09:55:39 -0700"
Subject: "=?UTF-8?B?SFdQTzI1MDIxNzAwMTQgWUlSVU4g5bm/5bee5Lq/5ram55S15a2Q5pyJ6ZmQ5YWs5Y+4IChORVcgUE8p?="
Attachment: "PO2502170014.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

588

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO2502170014.exe
File size:	693'256 bytes
SHA256 hash:	de9c905c7d05ee8775d644ecc9354ca87a1c74fe5eb23537c0bec8784e7dfaaa
MD5 hash:	08ca8e2f68acda38a9b8f3ecaaa13831
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL

SecuriteInfo.com.Win32.MalwareX-gen.31352.24052.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68527ca215ccda91b228bf94

Tags:

keylog spawn lien word

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/1c1bf399afbb2128937979f0a500979d511b8b90833869d400ad7119654b1305/results/dashboard

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/1c1bf399afbb2128937979f0a500979d511b8b90833869d400ad7119654b1305

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/1c1bf399afbb2128937979f0a500979d511b8b90833869d400ad7119654b1305

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

97%

Verdict:

Malware

File Type:

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250619-kj6d7aspt8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Checks computer location settings

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1c1bf399afbb2128937979f0a500979d511b8b90833869d400ad7119654b1305

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Runtime_Broker_Variant_1 Create hunting rule
Author:	Sn0wFr0$t
Description:	Detecting malicious Runtime Broker

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)