MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf1e8f2fc2dd05514be3e8f92abf5b266dfb1547cc611dabc0cc4eea5a1b7dfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf1e8f2fc2dd05514be3e8f92abf5b266dfb1547cc611dabc0cc4eea5a1b7dfe
SHA3-384 hash: 00caaa4d03cfcba7539a36aa70af31b7181a828a5f46dfc0eeb68e27e337332d85d91645901e25890432e17264fdbe1f
SHA1 hash: 9e15b2399ee3e22fc8d0190de137005ffe21d57c
MD5 hash: 4277289b0c0654dbc05a67af9ebbcbfd
humanhash: edward-fruit-three-jig
File name:vbs.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'945'562 bytes
First seen:2020-05-28 06:38:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d219f4681878926caf828436244e95f (1 x AveMariaRAT, 1 x AgentTesla)
ssdeep 24576:nGyyqtf9LgKCIfEX1uqcc6XpKGkGWWRvvbEIV2MxIRjadA+yHUsTScnSEDf2Uk0g:4ULRELcjpb7zRnb6+dA+gfSEqTcxi
Threatray 214 similar samples on MalwareBazaar
TLSH 1895237130F1C432E56360358D96C7A4F875FA2967B1694EBB940F1DAF317A29326703
Reporter abuse_ch
Tags:AgentTesla nVpn RAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: pro152-34.mxout.rediffmailpro.com
Sending IP: 119.252.152.34
From: sarkhej sundek <skj.sil@sundekintl.com>
Subject: INQUIRY FOR NEW ORDER-78557
Attachment: ORDER-78557.xlsm

Unknown RAT payload URL:
http://111.90.149.244/vbs.exe

Unknown RAT C2:
194.5.99.151:56780

Hosted on nVpn:

% Information related to '194.5.99.0 - 194.5.99.255'

% Abuse contact for '194.5.99.0 - 194.5.99.255' is 'abuse@inter-cloud.tech'

inetnum: 194.5.99.0 - 194.5.99.255
netname: Privacy_Online
remarks: ------------------------------------------------------------------------
remarks: This prefix is used by a non-logging VPN service provider.
remarks: We don't log any user activities.
remarks: We don't host anything else on our servers than VPN software (OpenVPN,
remarks: IKEv1 & 2, WireGuard ...).
remarks: Our customers can open up to 8 Ports (TCP & UDP).
remarks: We support the Tor Project: https://www.torproject.org
remarks: Before sending us potential complaints, please read:
remarks: https://www.torservers.net/abuse.html
remarks:
remarks: We are under constant pressure by Spamhaus.
remarks: Spamhaus issues tons of fake SBL listings in order to destroy our service.
remarks: They use fake identities, violate EU laws and hide outside the EU in
remarks: Andorra to avoid legal consequences.
remarks: Please don't trust this organization.
remarks: If you have any questions related to our service, please contact us
remarks: directly via e-mail: support@inter-cloud.tech
remarks:
remarks: Thank you.
remarks: ------------------------------------------------------------------------
admin-c: RA9926-RIPE
tech-c: RA9926-RIPE
org: ORG-NFAS6-RIPE
country: GB
status: ASSIGNED PA
mnt-by: inter-cloud-mnt
created: 2019-07-20T20:42:53Z
last-modified: 2020-03-10T21:28:31Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.Variant.Ser.Ursu.1823.15944.7336.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Foreign
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:45:46 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1b13660c52adcccc1cef45f137a3373f5615500a609c61a9872e5ed4336e629a
AgentTesla
27dbff4b16fa15497def710d494b48ad90c3a498c354cee50fc0e35081dcfbb7
AgentTesla
2d40a6c3d1200616055b55031daa8a6b010b3c99219f6b6da87bcd2b2f27d6c2
AgentTesla
329e8814efa351d1c58c275981a39cf0a9ef0f50d8eb8db9bbb8f70020d75204
AgentTesla
3a5943219f8400531a411b909b666337ba4f232d19e003a0128e0d699106f04f
AgentTesla
44c7ef261a066790a4ce332afc634fb5f89f3273c0c908ec02ab666088b27757
AgentTesla
73acff9ea3647f699cd645b09e652ca498eea7c5cee9f3cb573afda67a0ceeb2
AgentTesla
e131a045dc4874ee4eed8e75af0faeecaf86a80e18f13b9845a8b6f57686beec
AgentTesla
fae7f26d7b1d09486a585023081493b1315895d9ebf6dac3a56cdd4e32590424
AgentTesla
fd869766f1f735b4c1479ec1300fd63f4a203142e4ed0e6ac18f05d1cdba3ac8
AgentTesla
+ 204 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-c37stjbrte/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

CrimsonRAT

Excel file xlsm 7c70e7a86d9418de014123679e862d1a25097bd8d36ffdf059bdd02780b15d10

AgentTesla

Executable exe cf1e8f2fc2dd05514be3e8f92abf5b266dfb1547cc611dabc0cc4eea5a1b7dfe

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/370352/
  
Dropped by
SHA256 7c70e7a86d9418de014123679e862d1a25097bd8d36ffdf059bdd02780b15d10
  
Dropped by
MD5 af09aad33f978ce8e705534be9446398
  
Delivery method
Distributed via web download

Comments