MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f
SHA3-384 hash: c9104d4851fff31a3b96acf02caae4f9f35e8853d231d32c12ae65dd0cf4824e43d634d644336ff35d3f570eae3c8d00
SHA1 hash: 5f5b226a4a8a69ec33e408138bff6b2adaa50fcf
MD5 hash: 9b66e8c887f0dd97d7e4dba459a81e8f
humanhash: carbon-papa-arkansas-nineteen
File name:f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f
Download: download sample
Signature AgentTesla
Create hunting rule
File size:706'048 bytes
First seen:2023-03-09 23:00:46 UTC
Last seen:2023-03-10 07:08:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:im96yklSiyLiijbcbG6gj0mj95KuEY7SGKkID5lEbgrzx:tidiMbG6gj0mj95KuEYeGKkID5lEbgr1
TLSH T149E46B5D67EC6A1EF5BF0B36C0F115178BA4E852EB5FE74E048099A98C297C68C31783
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 0c3cfcfc3c410000 (1 x AsyncRAT, 1 x PureCrypter, 1 x AgentTesla)
Reporter Anonymous
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
220
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f
Verdict:
Malicious activity
Analysis date:
2023-03-09 23:02:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e9fd334f-71c6-4a45-a4f7-a00fd2f7f4c7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/373179/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1869.21889.3494.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a file
Enabling autorun by creating a file
Verdict:
No Threat
Threat level:
  10/10
Confidence:
57%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/640a652f7975027880142adb/reports/5eba38d6-4b7d-42cd-aa7f-c0cfe72e6e13/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/86e27b65-d790-4f30-9821-8e59381ca527
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1190836
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Uses dynamic DNS services
Uses the Telegram API (likely for C&C communication)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-03-09 16:49:02 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
5
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6g4av5igvl27b5bfcsuauds2taullgswom3vksmdkmrqrkz2tfxq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230309-2zjc2aaf62/
Behaviour
Suspicious use of AdjustPrivilegeToken
Uses Task Scheduler COM API
Unpacked files
SH256 hash:
f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f
MD5 hash:
9b66e8c887f0dd97d7e4dba459a81e8f
SHA1 hash:
5f5b226a4a8a69ec33e408138bff6b2adaa50fcf
Link:
https://www.unpac.me/results/eb8d05de-e84d-4b1a-b4d2-c507924670fa/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img fbc650a211348022558953fdecf70e8adf8dc6b839de02472e855089e990532f

AgentTesla

Executable exe f1b80af506aaf5f0f42514a80a0e5a9828b59a567337554983532308ab3a996f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/373179/
  
Dropped by
SHA256 fbc650a211348022558953fdecf70e8adf8dc6b839de02472e855089e990532f
  
Dropped by
MD5 f0fdab579e9ff3b074ac2432baade6c0

Comments