MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f900204674608d6536571629b7096726c395598825873805829006724cf593c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f900204674608d6536571629b7096726c395598825873805829006724cf593c
SHA3-384 hash: 203a2f34d52416b51e6716d68f00d3d610d19f8d853b36900b3ff4842ca6bf1a9b27c1b3c1a4fec870dc1659ba0ab344
SHA1 hash: 6e90f25c57bdf0c995d69273967d9dfbcbbead00
MD5 hash: df45e916be1be990552de066a450edec
humanhash: lamp-colorado-pluto-neptune
File name:MT103 0216009430 - Aviso de Transferencia Realizada.PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'198'592 bytes
First seen:2024-01-16 18:40:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 948cc502fe9226992dce9417f952fce3 (1'182 x CredentialFlusher, 446 x Formbook, 231 x AgentTesla)
ssdeep 24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aww841LYmvj3Kg:mTvC/MTQYxsWR7aww84hFrK
TLSH T17F459E4FB38280AEFEDA9D32CA56E2D1467869E60123A51F06DD1879F9F00F1173D663
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9aa4a4a48eb2b8c6 (9 x Formbook, 5 x AgentTesla, 2 x MailPassView)
Reporter malwarelabnet
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
355
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
RV_ ORDEN DE COMPRA URGENTE - Enero 2024.eml
Verdict:
Malicious activity
Analysis date:
2024-01-15 20:59:34 UTC
Tags:
maldoc loader exploit cve-2017-11882 stealer agenttesla
Link:
https://app.any.run/tasks/f076b98c-d24f-43ea-bb79-ea1a5d455903

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/471203/
Detection(s):
SecuriteInfo.com.Trojan.Generic.33203615.28472.17882.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit bladabindi coinminer control greyware keylogger lolbin masquerade packed shell32 threat
Link:
https://www.filescan.io/uploads/65a6cdc499da41ccd7d59681/reports/7bad2fc3-b5f7-4fd7-86cc-39247890c585/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1f900204674608d6536571629b7096726c395598825873805829006724cf593c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b56c4a7-cefd-48fe-90c6-fd3c693c443c
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1375618
Signature
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Contains functionality to log keystrokes (.Net Source)
Found API chain indicative of sandbox detection
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1f900204674608d6536571629b7096726c395598825873805829006724cf593c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f900204674608d6536571629b7096726c395598825873805829006724cf593c/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-01-15 18:34:04 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6iaebdhiyenmu3fofrjw4ewojwdsvmyqjmhhacyfeagojgple6a._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
agenttesla
Create hunting rule
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240116-xbrbhsheb8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Unpacked files
SH256 hash:
b67634b988dfb1f43e7ecd30579fe285e1e57740d646f6896b4f6a0d13cfb9dd
MD5 hash:
c5be9c39afdf0da89b281f61e8f5e721
SHA1 hash:
e20cb14555c8ad7bf9af5c6f2354e7fecc32b489
Detections:
win_agent_tesla_bytecodes_sep_2023
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
Link:
https://www.unpac.me/results/57cf5e4e-60e3-4aa0-9727-1a449770639e/
Parent samples :
39091a34d4907869f77d2a49695486151327daa7a290a964126a722f022d0159
1fbd630c0d6815afbd009cd30c31d84f3be81526d3a1b24ea9539d8e09e53d98
1f900204674608d6536571629b7096726c395598825873805829006724cf593c
SH256 hash:
1f900204674608d6536571629b7096726c395598825873805829006724cf593c
MD5 hash:
df45e916be1be990552de066a450edec
SHA1 hash:
6e90f25c57bdf0c995d69273967d9dfbcbbead00
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/57cf5e4e-60e3-4aa0-9727-1a449770639e/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1f9002046746/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f900204674608d6536571629b7096726c395598825873805829006724cf593c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV4
Create hunting rule
Author:kevoreilly
Description:AgentTesla Payload
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Generic_Threat_808f680e
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/471203/

Comments