MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1
SHA3-384 hash: 1162dc34f096c51297e6b8f4ebd957c5be4f2c873b90f94e29d769a68f4bf99ef72f34fd8b5660540750a851b092b631
SHA1 hash: efadf99046b4749ff344253cd3a6a5fc47b6a3d6
MD5 hash: c1a0b943fd3770ba123c52ffeefeda4b
humanhash: princess-seven-zebra-violet
File name:Fatura Ödemesi Hakkında.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:922'112 bytes
First seen:2024-02-07 09:34:03 UTC
Last seen:2024-02-07 11:35:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:OlhV+F8UWLwlhUbrDdNPtOLhwUzBuP0E8CC8h5dGw/MoxPcqTbsSqK/kD9c3h8:ihQCUKbXDdNPtAXoPK8HXd1bEKI9cx
TLSH T17F15D0F986061519D83535B8C7B363E917BD1EEABC42C70A94E835B8247E380361AF5F
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe geo TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
292
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1.exe
Verdict:
Malicious activity
Analysis date:
2024-02-07 10:28:36 UTC
Tags:
agenttesla stealer
Link:
https://app.any.run/tasks/b4ab6e04-288f-483b-a4c0-13843b0f22f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2511.4708.4108.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1604962e-9327-47c8-9492-6a6245433842
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1388203
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1388203 Sample: Fatura #U00d6demesi Hakk#U0... Startdate: 07/02/2024 Architecture: WINDOWS Score: 100 38 nogamobilya.com 2->38 40 mail.nogamobilya.com 2->40 52 Snort IDS alert for network traffic 2->52 54 Multi AV Scanner detection for domain / URL 2->54 56 Found malware configuration 2->56 58 13 other signatures 2->58 8 Fatura #U00d6demesi Hakk#U0131nda.exe 4 2->8         started        11 ctsdvwT.exe 3 2->11         started        13 ctsdvwT.exe 2->13         started        signatures3 process4 signatures5 60 Adds a directory exclusion to Windows Defender 8->60 62 Injects a PE file into a foreign processes 8->62 15 Fatura #U00d6demesi Hakk#U0131nda.exe 2 5 8->15         started        20 powershell.exe 23 8->20         started        22 Fatura #U00d6demesi Hakk#U0131nda.exe 8->22         started        24 Fatura #U00d6demesi Hakk#U0131nda.exe 8->24         started        64 Multi AV Scanner detection for dropped file 11->64 66 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->66 68 Machine Learning detection for dropped file 11->68 70 Contains functionality to register a low level keyboard hook 11->70 26 ctsdvwT.exe 2 11->26         started        28 ctsdvwT.exe 13->28         started        process6 dnsIp7 42 nogamobilya.com 185.85.236.83, 49714, 587 HEXANETFR Turkey 15->42 34 C:\Users\user\AppData\Roaming\...\ctsdvwT.exe, PE32 15->34 dropped 36 C:\Users\user\...\ctsdvwT.exe:Zone.Identifier, ASCII 15->36 dropped 44 Tries to steal Mail credentials (via file / registry access) 15->44 46 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->46 48 Installs a global keyboard hook 15->48 30 WmiPrvSE.exe 20->30         started        32 conhost.exe 20->32         started        50 Tries to harvest and steal browser information (history, passwords, etc) 28->50 file8 signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1/
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-02-06 09:05:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zty24dhojn3p6t4bzoqgbu62b2i4phca2jnig73xrixhagi2x3yq._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
agenttesla
Create hunting rule
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240207-ljtaasfea3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Unpacked files
SH256 hash:
8c99947294dde1da670de6e7af7c5283fea3968a12562df0bffaff0458206c79
MD5 hash:
257724a13622b54fc42409128b7a1659
SHA1 hash:
9b0ad7877b73ebe7e0941d270339f6b9ec1820ce
Link:
https://www.unpac.me/results/bfa58570-ab2b-4332-844c-9956f083cbd2/
SH256 hash:
4ad7f7faead2622899ef13cdc0a0d43fc8af2c6f3a0049b4517326802425b06a
MD5 hash:
df259eb6a1451890995484982a8bea61
SHA1 hash:
63bc375041ccc74842d23b3fe4e463e83d91e7d0
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/bfa58570-ab2b-4332-844c-9956f083cbd2/
Parent samples :
441cc4670d7c22a5b25f09d098e3d47022447e43f020b24f31e1d6ffc525a43f
1114073506daab881c22bce61bd90102035168e438f38e854f6ec4c06d6d32c7
1899cb937862bb84c5e4ab6a7211474a014cee50d4a05099a17ffb63ce8be0be
ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1
86caff3276f512d98f8551121b2a9c0fa2a4c40291569af16fc08cc14ff3dae2
70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47
65425223dfa8ae8334cf347355822d3fe7589ccd6b35733db1e473a335c0e49e
35283152bb31940827ea64cdef4baf0f332f38b348d83dd3c34364b97f6d3d87
9dfd52d9008fad9915a2ce18b0f9e9a2dc6c513f7396d049a82faf97410950c1
4d907c3d7974732445e036c17d48ffa394628c26a25c5eac76eafd101d4299a3
0385e72feabb9b4207ae2266774849feb9d5179d036b4292e5ffed33c27a5f4a
7171159688e2f33a0545f09701d5d20ac73314cefc2cef8b62e8d4632fa650b3
29b22f8a33e8dd40cec2001bb1634769e1ab182fa93f4cfd90b13d8e3d955c28
SH256 hash:
f4d18078f32176e0ebde16a6cf345d09e6933fb38222797d273f00739f605f7a
MD5 hash:
9bdf381423d30a68a3303e6b6b5e49a1
SHA1 hash:
4cfe7c6e91e7095ff2806c864b8310b7c76625da
Link:
https://www.unpac.me/results/bfa58570-ab2b-4332-844c-9956f083cbd2/
SH256 hash:
1d1981990fa48538518b1e9bfd604feef2595c2a102fa4116ae0e8cc0506980e
MD5 hash:
da7225d0180613d053d85e213ff16877
SHA1 hash:
3db381937df039aeeebc8f920d1c830f9f5b3382
Link:
https://www.unpac.me/results/bfa58570-ab2b-4332-844c-9956f083cbd2/
SH256 hash:
731223cc23140a70d6d7cb3a6894c8fc27b742b1f3dba02ffc82a0809ad4951e
MD5 hash:
7e817168f5b53affbea32c93db801a7e
SHA1 hash:
33c1e77ff5a4e446f0e6aefc68251be343ec38b9
Link:
https://www.unpac.me/results/bfa58570-ab2b-4332-844c-9956f083cbd2/
SH256 hash:
ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1
MD5 hash:
c1a0b943fd3770ba123c52ffeefeda4b
SHA1 hash:
efadf99046b4749ff344253cd3a6a5fc47b6a3d6
Link:
https://www.unpac.me/results/bfa58570-ab2b-4332-844c-9956f083cbd2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ccf1ae0cee4b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments