MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1e7a7630a34a86e571d6098a6cc339c9dff8ad307ad9d4cff9f87089c658fbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1e7a7630a34a86e571d6098a6cc339c9dff8ad307ad9d4cff9f87089c658fbe
SHA3-384 hash: d5dfe78127d5796cd485d19d523040a40f465ba74829696b3e75b111cfd874b6d8525ee7d7e7551eb1218ec3a210751e
SHA1 hash: 78d4dea2da0bd9292710abc90b541704014e70b9
MD5 hash: a94461b292056701b8d252eb2c3402d8
humanhash: colorado-lemon-equal-coffee
File name:Tax Invoice IN101848.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:942'592 bytes
First seen:2021-07-08 11:52:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:UnRrDp0za2rcoFTGOkE+3aB+CYFQXl5Ag3Qqx6Nk:kRnp0za2rcoIOkE+3BCYyvx3N
Threatray 6'455 similar samples on MalwareBazaar
TLSH T1F115F7BD313176EEDCABC2398B741C6CAF94717B830B622790172599998CA87DF144B3
Reporter cocaman
Tags:AgentTesla exe INVOICE

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Tax Invoice IN101848.exe
Verdict:
Malicious activity
Analysis date:
2021-07-08 11:56:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7287ea7c-c848-45e4-8b7c-fe908625ef93

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170430/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.908-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/580bb1b6-24fc-4401-b40c-fdab4b11f8f6
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
0 / 100
Link:
https://www.joesandbox.com/analysis/813448
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f1e7a7630a34a86e571d6098a6cc339c9dff8ad307ad9d4cff9f87089c658fbe/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-08 11:41:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ht2oyykgsug4vy5mcmkntbttso77cwta6wz2th7t6dqrhdfr67a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05edc3fe4fb4bfa22e5e3ce66e66a4f258adc1aebbb26142bafd1a9264feb4b9
AgentTesla
1c4cbe5a3adfa0a596eabff32c6a43fe2f5fc2be1dcf71bddbd0c1200d7451a8
AgentTesla
2b68292613b0256903e4f2e98813f8f2bb352317e126aa0c62d24f814c642125
AgentTesla
3b274112221489ff1408360fbd3b4d691e5d0b10a28399fd2c4690336e6e9cdf
AgentTesla
3f5a7effc340c773a1ef95a0c709a9e92e3daccd1e584ba3e8c1270fdd54dc7c
AgentTesla
723783b2f0898dc51e3139a7845b62bfacd5ffc44d61ab938162892a28ade593
AgentTesla
9898c37e93d4e9a054c013f34ca57c1aa9130112c9104386219f94e1125d0b97
AgentTesla
acff3b5247f863e48033ccd2ee7db353f918c6362b9a5beaaac8dbf42bbde5f4
AgentTesla
c5105375437a69ac2d05920a26fd126a75a4df6678be884a81ee8577e49ed42f
AgentTesla
ebd27ef6fbbbf184d596b9fb113c92c32546abe2a379c12707691e43dfb73472
AgentTesla
+ 6'445 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210708-c6zcrhbrr2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
64d08847245fe67efa2cfc62b560db80badc8e6157661f598457168ab6ef6f02
MD5 hash:
cffa587c72abe26aa24a17d114f78524
SHA1 hash:
6654b9ff712f8356afc8c95d65de8dadab0a4118
Link:
https://www.unpac.me/results/53a9283d-500e-4d36-b635-f8a377d0477d/
SH256 hash:
36eccdd719a64716c6592b98de80be5d294a3dfe25c5378d28fc3f90612d7a60
MD5 hash:
d7c700c1002b44ce70810f097772097a
SHA1 hash:
12e367ad2041c44f4c48c000f4ecbdcd02b84b9d
Link:
https://www.unpac.me/results/53a9283d-500e-4d36-b635-f8a377d0477d/
SH256 hash:
5209992fd1f96cd1959efb5e1afa71f5c9ae2ab4430e258fe9d0ec915098d110
MD5 hash:
257ca10e5cbb2f8bdf0ae6f3e900e11e
SHA1 hash:
9d25ee80dbe3bbce5ab4479912c5e21b19b6aeec
Link:
https://www.unpac.me/results/53a9283d-500e-4d36-b635-f8a377d0477d/
SH256 hash:
f1e7a7630a34a86e571d6098a6cc339c9dff8ad307ad9d4cff9f87089c658fbe
MD5 hash:
a94461b292056701b8d252eb2c3402d8
SHA1 hash:
78d4dea2da0bd9292710abc90b541704014e70b9
Link:
https://www.unpac.me/results/53a9283d-500e-4d36-b635-f8a377d0477d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/f1e7a7630a34a86e571d6098a6cc339c9dff8ad307ad9d4cff9f87089c658fbe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z eec4d64ea8a5fd4dc810a5d0e3c52e42035c2192c868bde45919a3709b884d23

AgentTesla

Executable exe f1e7a7630a34a86e571d6098a6cc339c9dff8ad307ad9d4cff9f87089c658fbe

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 eec4d64ea8a5fd4dc810a5d0e3c52e42035c2192c868bde45919a3709b884d23
Cape
Cape
https://www.capesandbox.com/analysis/170430/

Comments