MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 20


Intelligence 20 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c
SHA3-384 hash: 72deaf22e79674996caa6ae5bf9c284d65419dc1cfef341206fc36eb54706905f2e9ddab4636f564bf49d67fd77d708c
SHA1 hash: dcf629e3a6df180a90e30ef049ae94d00fd6235e
MD5 hash: 2d3233e3158010659b9bcedeb5a7bd91
humanhash: low-tennessee-east-sink
File name:Quotation.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'246'720 bytes
First seen:2026-03-18 12:47:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1895460fffad9475fda0c84755ecfee1 (438 x Formbook, 137 x AgentTesla, 67 x a310Logger)
ssdeep 24576:U5EmXFtKaL4/oFe5T9yyXYfP1ijXdacRReQe7kLW1/uYf0dDJsY5:UPVt/LZeJbInQRacRTh+eS
TLSH T19645BF027391C062FFAB92734B5AF6115BBC79260123AA1F13981D79FE701B1563E7A3
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
AutoIt
Details
AutoIt
extracted scripts and files
Link:
https://research.acce.ciphertechsolutions.com/results/e1f43222-b4f7-44bd-87b0-567e96cf4e7e/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
_1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c.exe
Verdict:
Malicious activity
Analysis date:
2026-03-18 12:48:27 UTC
Tags:
evasion stealer agenttesla netreactor
Link:
https://app.any.run/tasks/8e17e36a-5f7d-47b4-bc83-db1d081c289f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/57981/
Detection(s):
SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ba9f1393b644ca466b4c75
Tags:
autoit emotet lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Launching a service
Changing a file
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script fingerprint keylogger microsoft_visual_cc packed similar-threat
Link:
https://www.filescan.io/uploads/69ba9f11677ac46843a68130/reports/54fe22d6-bfb9-43d3-bb6e-9b5c1b1daf63/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c
Result
Gathering data
Verdict:
Malicious
File Type:
exe x32
Link:
https://opentip.kaspersky.com/1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4c9c4e87-5375-41aa-9fd2-13893bf3c1f3
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c
Threat name:
Win32.Trojan.ShellcodeCrypter
Create hunting rule
Status:
Malicious
First seen:
2026-03-18 12:47:11 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dtycy737mlzc42rclf37t5znt2mlmdtbico22coyx24jzafdhkoa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
unc_loader_001
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/260318-p1wnjafz8q/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
AgentTesla
Agenttesla family
Unpacked files
SH256 hash:
1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c
MD5 hash:
2d3233e3158010659b9bcedeb5a7bd91
SHA1 hash:
dcf629e3a6df180a90e30ef049ae94d00fd6235e
Link:
https://www.unpac.me/results/20d3ed38-d3cb-42cd-bc8c-c52b76c4bde2/
SH256 hash:
87d1627c64883b55684f1c15eeee39e743370e8e1efd8ae3c9f2f24f790b3bc7
MD5 hash:
7f3911f647f1841aed28f4e74357855f
SHA1 hash:
b8bd813c74a0adf7071303398a211d4d664e8c64
Detections:
win_samsam_auto
Create hunting rule
SUSP_OBF_NET_Reactor_Native_Stub_Jan24
Create hunting rule
MAL_Malware_Imphash_Mar23_1
Create hunting rule
MetaStealer_NET_Reactor_packer
Create hunting rule
MALWARE_Win_RedLine
Create hunting rule
Link:
https://www.unpac.me/results/20d3ed38-d3cb-42cd-bc8c-c52b76c4bde2/
SH256 hash:
f935b554b822323d68f676674903f007c7a7834bcc8aaebde44f5fc76172d1a1
MD5 hash:
272cedc2e78b43ff680393a3d8fa7443
SHA1 hash:
09423671a2d8d4deffa44d76c36255b9b284cf5a
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
RedLine_Campaign_June2021
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/20d3ed38-d3cb-42cd-bc8c-c52b76c4bde2/
SH256 hash:
8e25e2ac52f428f7938366d7c818cb1843262a1efb4e39cfc68a1aa78d5644d9
MD5 hash:
94ef4dd6d787ae2620f1383bf1d8b005
SHA1 hash:
95ee675af0499d208b88d2a9a7daf5bb8c6267d8
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/20d3ed38-d3cb-42cd-bc8c-c52b76c4bde2/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1cf02c7f7f62/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:win_samsam_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/57981/

Comments