MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f8c2feb6b1163a4801631c2824b3f38c12e2db389730e692f3310eb4df6c0db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f8c2feb6b1163a4801631c2824b3f38c12e2db389730e692f3310eb4df6c0db
SHA3-384 hash: ce832d9b7b4e6aff794c3bba8c68c9b74ac339c25fb0d7447daf12024113b4d555463174d4b55e2fdf0bd4232c934e2d
SHA1 hash: b2875e09baf637f462d0abcf24de9351269f9a8e
MD5 hash: 9cfe9935060a5e702cc6153e141003b4
humanhash: vegan-papa-vermont-five
File name:ark.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:563'712 bytes
First seen:2023-04-07 07:49:29 UTC
Last seen:2023-04-10 21:43:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:SGJzDnnFyrZfdjxBnoxqzHuCEHV+RhtWQrDtSsM:vnF8dzHuCMVUhtWgBS
Threatray 1'969 similar samples on MalwareBazaar
TLSH T127C4D0E08604CAB7EAF80176D01A06A867F17CB4D550F3E33E9975C2F7B27A743A5506
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon a7b8c4e68a94d483 (10 x AgentTesla, 1 x SnakeKeylogger)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
298
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ark.exe
Verdict:
Malicious activity
Analysis date:
2023-04-07 07:51:24 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e5f46335-1967-4357-83b2-6314af8b10c9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/380767/
Detection(s):
Sanesecurity.Rogue.0hr.20230407-0034.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Sending a custom TCP request
Reading critical registry keys
Sending an HTTP GET request
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook packed remcos
Link:
https://www.filescan.io/uploads/642fcb2d2254dc8912049dbf/reports/721dcd85-f97f-4dcd-b96f-9efac43990c6/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1f8c2feb6b1163a4801631c2824b3f38c12e2db389730e692f3310eb4df6c0db
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9bfbd62d-951a-484e-ae63-a75c87e5e061
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1210151
Signature
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f8c2feb6b1163a4801631c2824b3f38c12e2db389730e692f3310eb4df6c0db/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-04-06 04:57:37 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
18 of 37 (48.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6gc723lcfr2jaawghbiesz7hdas4lntrfzq42jpgmiowtpwydnq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07e4041c5c6f723155aaed3576af605dedd39b26931648918af53af03fc6bb0a
AgentTesla
2e99a044f7b869992835fd5bbf9d5d74f55b94c2fcf7d29e3781be3bb345a128
AgentTesla
41857a1bfb1cda7337d39a4c6bcec253fb44532179f9cb12e919608f227e3dcb
AgentTesla
58d36f362adeee043760e5ed367b54e3dbdf4c4022f12d1c88f923f286d1f301
AgentTesla
8f772ee3b7cf1eeff0c038de31930f85200dc7334c1ba40223d1ac1d1a392b8f
AgentTesla
a530d39c6e1b1505e94f7026eb82191062e6a0f62ddbb03a4bcf0eb295c3d518
AgentTesla
a6ffd66b9b3aa45638bee7e9a43b1110d2ae5b42fd10d0ff316a454ed3ef1d49
AgentTesla
aad777a2d2f4c889859ca2fbdc9d2bc782cf989c31d95be12abda966f4cbaf19
AgentTesla
b8240784dc76e0d06183f6e4518b2a4aa24a7cbe28f275e13ffa35b26d7df343
AgentTesla
d3cbeafcefe0aa050926d93155a7b57664103941038a9bbeecd67d9668083a12
AgentTesla
+ 1'959 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230407-jn9fzaad7w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
AgentTesla
Unpacked files
SH256 hash:
9f457e38702873e2f7d839b309ca1a25a5529c9d56d22f56945cc5f94dc9549c
MD5 hash:
1bc937b174188686f93e4c4a2af930c8
SHA1 hash:
c8f85c93b647ebb2ab1b689160b996590e976711
Link:
https://www.unpac.me/results/897c3209-325a-4567-9bf9-27cbfb0bb3c5/
SH256 hash:
08c179b78b53495d68418194fab544b5ba8ca48b3324f71b8713b16a04b99d35
MD5 hash:
1e66bacfac2eb21fd676c35ff3fd618b
SHA1 hash:
7cab6e44ab5c5c5327560c91ef6de9e0446a5386
Link:
https://www.unpac.me/results/897c3209-325a-4567-9bf9-27cbfb0bb3c5/
SH256 hash:
ea8d4c91ec5bba5e1db6c17730d7ba5cdbb5ff3c1a777f70c90e91ce599d9b5d
MD5 hash:
27f5124bf8f451bca8d8a15c73c4f521
SHA1 hash:
5fd557e109b8fd1c3b362b64f0ba9f1600c07211
Link:
https://www.unpac.me/results/897c3209-325a-4567-9bf9-27cbfb0bb3c5/
SH256 hash:
1f8c2feb6b1163a4801631c2824b3f38c12e2db389730e692f3310eb4df6c0db
MD5 hash:
9cfe9935060a5e702cc6153e141003b4
SHA1 hash:
b2875e09baf637f462d0abcf24de9351269f9a8e
Link:
https://www.unpac.me/results/897c3209-325a-4567-9bf9-27cbfb0bb3c5/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1f8c2feb6b11/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f8c2feb6b1163a4801631c2824b3f38c12e2db389730e692f3310eb4df6c0db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 11733e025c60b01fa64c677d151445ed8603cf9835b1aae86a2d2200c5cd15a1

AgentTesla

Executable exe 1f8c2feb6b1163a4801631c2824b3f38c12e2db389730e692f3310eb4df6c0db

(this sample)

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/380767/
  
Dropped by
SHA256 11733e025c60b01fa64c677d151445ed8603cf9835b1aae86a2d2200c5cd15a1
  
Dropped by
MD5 a8d76b508f953bcaed3cdf0fde52f578

Comments