MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1c1b1805bde95505778d0aaf0e8eef6e4fdf46600edaef7c4644cd3e78f633a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1c1b1805bde95505778d0aaf0e8eef6e4fdf46600edaef7c4644cd3e78f633a
SHA3-384 hash: 15295b216aba3b3192ce05a3b93d11d171ea5f690a5a39482eb76cf10e2369bbc9c773921fa6cb833d1f47f70a97d517
SHA1 hash: b5f2dce191979b5481d5bc58be73417c07f73239
MD5 hash: 66bfe22d3758af1896a77358aba476cb
humanhash: kilo-golf-enemy-autumn
File name:Payment_Advice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:855'552 bytes
First seen:2021-08-11 10:55:40 UTC
Last seen:2021-08-11 11:55:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:1CwizXZioCKNarHK7zcxgLT2GwC4efI2I7CzRLRG4GkUHUDYc:1pol0MT2J+bzRF/SuY
Threatray 8'624 similar samples on MalwareBazaar
TLSH T1B405D02BB7C48D18DA730D77EC9D50109AB9EC035A83DB7FA0E07A29583B759943326D
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
279
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment_Advice.exe
Verdict:
Malicious activity
Analysis date:
2021-08-11 10:56:59 UTC
Tags:
keylogger stealer agenttesla
Link:
https://app.any.run/tasks/2ac43ee0-9b1a-4772-bb9b-f8c7c7744a51

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178194/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.993.20109.17092.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e5dc190b-28b1-49f0-802f-70afe8bd9725
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/830835
Signature
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 463262 Sample: Payment_Advice.exe Startdate: 11/08/2021 Architecture: WINDOWS Score: 100 51 Found malware configuration 2->51 53 Multi AV Scanner detection for dropped file 2->53 55 Yara detected AgentTesla 2->55 57 6 other signatures 2->57 7 Payment_Advice.exe 7 2->7         started        11 newapp.exe 4 2->11         started        14 newapp.exe 3 2->14         started        process3 dnsIp4 39 C:\Users\user\AppData\...\WIxfkBehsw.exe, PE32 7->39 dropped 41 C:\Users\...\WIxfkBehsw.exe:Zone.Identifier, ASCII 7->41 dropped 43 C:\Users\user\AppData\Local\...\tmp44D1.tmp, XML 7->43 dropped 45 C:\Users\user\...\Payment_Advice.exe.log, ASCII 7->45 dropped 67 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->67 69 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->69 71 Uses schtasks.exe or at.exe to add and modify task schedules 7->71 16 Payment_Advice.exe 2 5 7->16         started        21 schtasks.exe 1 7->21         started        49 192.168.2.1 unknown unknown 11->49 73 Multi AV Scanner detection for dropped file 11->73 75 Machine Learning detection for dropped file 11->75 77 Injects a PE file into a foreign processes 11->77 23 schtasks.exe 11->23         started        25 newapp.exe 11->25         started        27 newapp.exe 11->27         started        29 newapp.exe 11->29         started        file5 signatures6 process7 dnsIp8 47 mail.privateemail.com 198.54.122.60, 49739, 587 NAMECHEAP-NETUS United States 16->47 35 C:\Users\user\AppData\Roaming\...\newapp.exe, PE32 16->35 dropped 37 C:\Users\user\...\newapp.exe:Zone.Identifier, ASCII 16->37 dropped 59 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->59 61 Moves itself to temp directory 16->61 63 Tries to steal Mail credentials (via file access) 16->63 65 3 other signatures 16->65 31 conhost.exe 21->31         started        33 conhost.exe 23->33         started        file9 signatures10 process11
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c1c1b1805bde95505778d0aaf0e8eef6e4fdf46600edaef7c4644cd3e78f633a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 10:56:09 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yha3dac332kvav3y2cvpb2ho63sp35dgadw2556emrgnhz4pmm5a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0bc981fd0177a3032289751031abc774855a142b10abf42f6c34882d328e3940
AgentTesla
0f581ed2051c4a3b6f4d7d6e63c3a90ccf07f3d2054b0ec88c05826102749680
AgentTesla
19f512ee634d2d47156551904a25f5b650083c60a536079c11c512edd6914c17
AgentTesla
6d3deba9b84a0196b94370ee9a1201893fcacacc6736638407d0c4b11b7995a2
AgentTesla
8c9a601f38c17856c34d8a311c6ae80c7a2038e42c554da0ae0a0555b2f5f285
AgentTesla
b544726a7092ac0a8c503181644850292e01b7245808815d800f85e008c533d5
AgentTesla
c345fbabcb3e55e64341e860bb2916ba52ddea44257d8fa5b79f2ae7062734c8
AgentTesla
e3beff629214f8c0517959944ebad8ec53bfd74988bf1a369d36fa12c9d5e58c
AgentTesla
ecc1fd1b10f173ed89edb0288c945642d67c2e19a70f8f12775361cfccb4c641
AgentTesla
+ 8'614 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210811-dlvamhxebs/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
78837d9dadce3f77aa5b42f4f2b34ff8d074bda7a65eefec128fc15a742c5cf8
MD5 hash:
ba1e62c1b42e734f6f09ab98bd7ede0d
SHA1 hash:
e98eaf017328b7f265fd818052870110e2756961
Link:
https://www.unpac.me/results/8d42eca8-c602-461a-813e-5b0c8621c8b3/
SH256 hash:
c52788913abe9efe482fa583bc802d675f438ffdd98f66bf615ee4d00a0cc961
MD5 hash:
7542419c0e3862d977fa6ad0fad6f5e8
SHA1 hash:
b029d649e3e4a92b71fe4c30729ef11e05c8f526
Link:
https://www.unpac.me/results/8d42eca8-c602-461a-813e-5b0c8621c8b3/
SH256 hash:
ed0dd1e2260da7b03c8b80e0b45e8fef44be722c1e8c41e078c1a25ed0d18ecc
MD5 hash:
6057ce35bd926dd6d49dedfa9cc18372
SHA1 hash:
1f4e44e1740ffbd91129ac3a37d22845bc52c158
Link:
https://www.unpac.me/results/8d42eca8-c602-461a-813e-5b0c8621c8b3/
SH256 hash:
c1c1b1805bde95505778d0aaf0e8eef6e4fdf46600edaef7c4644cd3e78f633a
MD5 hash:
66bfe22d3758af1896a77358aba476cb
SHA1 hash:
b5f2dce191979b5481d5bc58be73417c07f73239
Link:
https://www.unpac.me/results/8d42eca8-c602-461a-813e-5b0c8621c8b3/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c1c1b1805bde/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1c1b1805bde95505778d0aaf0e8eef6e4fdf46600edaef7c4644cd3e78f633a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe c1c1b1805bde95505778d0aaf0e8eef6e4fdf46600edaef7c4644cd3e78f633a

(this sample)

  
Dropped by
null
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/178194/

Comments