MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cf2c4b90a84ce31c99a4b74ed546b17b2332a868f75293f237ea0bb0a5835c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cf2c4b90a84ce31c99a4b74ed546b17b2332a868f75293f237ea0bb0a5835c4
SHA3-384 hash: 9ddad58ead375a101efd13a7b051ec7a5918a316c3ad7f365648047d21593cad0ef047cfad719ee42e52248bb0f08d06
SHA1 hash: fe31621bb28cc4621da745da0a37eec00c554c69
MD5 hash: 0e778784f51810563f83970a87c6564b
humanhash: twelve-oven-september-uncle
File name:PURCHASE ORDER pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:785'920 bytes
First seen:2021-04-06 08:14:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:bMOVFV08VFVZ1Q7Ey+ZFRilg0A9OHheR05WXcd9fXUruHtDqICxn5Cegefqm9pbg:bMOVFV08VFVg7ElyS0A0HER05WsUuHZp
Threatray 3'700 similar samples on MalwareBazaar
TLSH C0F4BE213E589F69E43EEB39D421110083F0FD06D32AE65F7D9A3CD835A3B558A62E53
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: alkuhaimi.com
Sending IP: 193.56.29.191
From: General Manager<rud-division@alkuhaimi.com>
Subject: PURCHASE ORDER
Attachment: PURCHASE ORDER pdf.z (contains "PURCHASE ORDER pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE ORDER pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-04-06 08:27:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2ff5c759-77b0-454c-a643-6a3e34edc9bf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132608/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.624.31168.18694.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/667289
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 382572 Sample: PURCHASE ORDER pdf.exe Startdate: 06/04/2021 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Multi AV Scanner detection for dropped file 2->42 44 Sigma detected: Scheduled temp file as task from temp location 2->44 46 10 other signatures 2->46 7 PURCHASE ORDER pdf.exe 7 2->7         started        process3 file4 30 C:\Users\user\AppData\...\IVtlVeZNwf.exe, PE32 7->30 dropped 32 C:\Users\...\IVtlVeZNwf.exe:Zone.Identifier, ASCII 7->32 dropped 34 C:\Users\user\AppData\Local\Temp\tmp944.tmp, XML 7->34 dropped 36 C:\Users\user\...\PURCHASE ORDER pdf.exe.log, ASCII 7->36 dropped 48 Adds a directory exclusion to Windows Defender 7->48 50 Injects a PE file into a foreign processes 7->50 11 PURCHASE ORDER pdf.exe 7->11         started        13 powershell.exe 26 7->13         started        15 powershell.exe 24 7->15         started        17 2 other processes 7->17 signatures5 process6 process7 19 dw20.exe 11->19         started        22 conhost.exe 13->22         started        24 conhost.exe 15->24         started        26 conhost.exe 17->26         started        28 conhost.exe 17->28         started        dnsIp8 38 192.168.2.1 unknown unknown 19->38
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cf2c4b90a84ce31c99a4b74ed546b17b2332a868f75293f237ea0bb0a5835c4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 02:46:23 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dtzmjoikqthddsm2jn2o2vdlc6zdgkugr52sspzdp2qlwcsygxca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0156cc74dc52bcb6c9e1ea57e4e68825fb45a506e17701895e056a677d413184
AgentTesla
1b3f97b6b5e4553840b55eacf4c1de1746528a33bd7fcda33670d07d36baf9a1
AgentTesla
46b2de8c35b95976f4d0bc89ea0cf88c8669330b2b04812e0b0b105623356540
AgentTesla
73b77bdd8bc6a9970ee92c82221d492a3fa91db8c1ccd09c48fcf732c81f459f
AgentTesla
909fbce815ea71ef959b37bb5dc6c18eaea743019b66fae2af196473cffb17b1
AgentTesla
a3c681d1ff3050ae9bf7c5280bf7f8f3e1b22b5b560ef4ec18225aa541e521b5
AgentTesla
b73af6301fd4b0efff09e43dac97b8abf2e3d8d8eec3bee435002e320eaedf5f
AgentTesla
b8a9e94c8bbe43c7684e509ae89eb4d74b28a7fb3d5504c559f555c1e453bdd7
AgentTesla
f9badeca5248fcde81242288830c93e73449871f41291cea03a5d1c4cba51cec
AgentTesla
ff03883690595b9a19709af263cb2282595a77effca7bd98c5a205ff0da852a0
AgentTesla
+ 3'690 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210406-456xbkqxc6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6590b9ec4fa84e44c372fda26f47d6d58859d74869621c6bdd4086e6ae411379
MD5 hash:
95dfa1a9015a17a1d49b4faa3f3d999d
SHA1 hash:
427b72727b28436554d0443d797f19b2ea37cc16
Link:
https://www.unpac.me/results/e22d4b49-7f33-414e-9441-cd23cd373902/
SH256 hash:
1cf2c4b90a84ce31c99a4b74ed546b17b2332a868f75293f237ea0bb0a5835c4
MD5 hash:
0e778784f51810563f83970a87c6564b
SHA1 hash:
fe31621bb28cc4621da745da0a37eec00c554c69
Link:
https://www.unpac.me/results/e22d4b49-7f33-414e-9441-cd23cd373902/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1cf2c4b90a84ce31c99a4b74ed546b17b2332a868f75293f237ea0bb0a5835c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z c1e7e5e0f02dd6d74cd6e5c0a1073df947196f72fc76ed28016bccbd3fd6377a

AgentTesla

Executable exe 1cf2c4b90a84ce31c99a4b74ed546b17b2332a868f75293f237ea0bb0a5835c4

(this sample)

  
Dropped by
MD5 5b00109fbd34f752be8ac1a429ed586c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/132608/
  
Dropped by
SHA256 c1e7e5e0f02dd6d74cd6e5c0a1073df947196f72fc76ed28016bccbd3fd6377a

Comments