MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84
SHA3-384 hash: b5a54469ad19c118736d96d57fcb446dfe16fdfbf8eef54a227867c6018f3bdd40e5086035a8dde0a1bd74d292ad1527
SHA1 hash: 7cd6d1cd3e179335c6b4b99a443799eb0d15b036
MD5 hash: fcc8cbfcef7fda3cf7ee95bd020c3a31
humanhash: venus-triple-one-missouri
File name:Order FC22068032478332.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:958'976 bytes
First seen:2023-06-07 14:48:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Rces835+po/LTofA8Hx7JnRu5wKs3Pan0Af/1B:Ges835+pojEo8HxXKs34X
TLSH T15515913816741E62817AE26D95D9F91BFA544CD3360CDC1E8AC64FDA4A03B32E1CED1E
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order FC22068032478332.exe
Verdict:
Malicious activity
Analysis date:
2023-06-07 14:50:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ee62f3fc-b58c-4a03-a6b6-dc15b2a560df

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XorStringsNET
Create hunting rule
Link:
https://www.capesandbox.com/analysis/396511/
Detection(s):
SecuriteInfo.com.Trojan.Siggen20.58000.12915.25896.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
formbook lolbin packed
Link:
https://www.filescan.io/uploads/648098e2e7c46d7f750d5dfa/reports/79c3d963-d1b7-43d3-b987-d4d453014a8c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ca5c0991-9ac6-4c93-87b9-f034f8a0aab1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1250421
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2023-06-04 16:05:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
31
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ygdb6sf4q2cekp6hum43fo5me3gxtywbivygazvhpofljatgbsca._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230607-r61ksacd7y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/15ea596f-654f-46f9-9884-33d7c96529ce/
SH256 hash:
dc9275fd51b114be767111317b27de4a3bf8825b8f6442b1de3b3d5315498a87
MD5 hash:
e96714cbcfe184e978065bb7e9e169e0
SHA1 hash:
9320bfce32226555848d7be5d38492920ef4e53b
Link:
https://www.unpac.me/results/15ea596f-654f-46f9-9884-33d7c96529ce/
SH256 hash:
0b1897b292de2f3b6ee82f3945555a972c92818eab545a8f50af82b25d4610a5
MD5 hash:
5b7e30ad0f77587dcc80a9e60913bcdb
SHA1 hash:
87f85c59910e3447d5f9869cf52363f3cebf7d56
Link:
https://www.unpac.me/results/15ea596f-654f-46f9-9884-33d7c96529ce/
SH256 hash:
6024b7c1001f91e5504a4b4f048a2b32951919bd85a044ae53eac46de6108c0a
MD5 hash:
0df991273c21ede9c00e1993062ad72f
SHA1 hash:
68326302ccab48682ab7c653f083035e0422c796
Link:
https://www.unpac.me/results/15ea596f-654f-46f9-9884-33d7c96529ce/
SH256 hash:
f079da0dfbc9855277ae9d398b58bf2f1330a20008a607dc12b0279f3baaba0e
MD5 hash:
2aeb41c8c1ce3ad1309ba4ee7b21783c
SHA1 hash:
4681a726a038fd9e7226c8e8c7bbca13c7162262
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/15ea596f-654f-46f9-9884-33d7c96529ce/
Parent samples :
cd8bc55c70d85611ef59efe45a5676da4e0b82f067cf188035fe9c28be2c591f
b3ca0b93eff9f2f129fe069e2b7dc734f749db4d098a9be27e28e36519b3fb70
f3b4b1719930593f8c1e135c3cc9d40567cd2077600fceb95aabed24792a5252
c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84
b483fa2b04ee2305e50ec070450c43c4feef6d98a30f01aa1f003f11ffad2aa4
6d2a00d71cfe1ac88de75df0150145f8800668afd66cec2c73b0eeae2e4d4b5f
2b4cf6b7907df730c69b34f85e473d4c826c3bc8d423a79b5d7cf0b2a2414b95
SH256 hash:
c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84
MD5 hash:
fcc8cbfcef7fda3cf7ee95bd020c3a31
SHA1 hash:
7cd6d1cd3e179335c6b4b99a443799eb0d15b036
Link:
https://www.unpac.me/results/15ea596f-654f-46f9-9884-33d7c96529ce/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c1861f48bc86/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9d99e92f740dd7c27105df1172ae3787f3b540d846385f61d302550c372391ff

AgentTesla

Executable exe c1861f48bc8684453fc7a339b2bbac26cd79e2c145706066a77b8ab482660c84

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 9d99e92f740dd7c27105df1172ae3787f3b540d846385f61d302550c372391ff
Cape
Cape
https://www.capesandbox.com/analysis/396511/
  
Dropped by
MD5 e34adef9af9102860d0275d450cb09b1

Comments