MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15117a98b97b3b6c7b976692a0878f4f0031497a5ff7907e88fa9c68509428a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15117a98b97b3b6c7b976692a0878f4f0031497a5ff7907e88fa9c68509428a5
SHA3-384 hash: ada7a2265ca61f19b6095810810d44ebf16659ee5d5f2583185e2c0c02f53abf2e94a806e9c3dc54540dc519a9d15340
SHA1 hash: 681ef1d8a11d864ae6ba6f4cd3cdf7d1c8d3913c
MD5 hash: f5a5fc6267f1ec0264a061702e6850a2
humanhash: kitten-zulu-fillet-south
File name:f5a5fc6267f1ec0264a061702e6850a2.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:708'096 bytes
First seen:2021-02-08 07:11:55 UTC
Last seen:2021-02-08 09:08:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:a9rCXaQGdmlZvjcXJxCoUhYEwwPE7apITcuVlkkJ6U9:a9rEaQGdmrAXyoIYj7Wpt0lvB
Threatray 2'491 similar samples on MalwareBazaar
TLSH 22E4E09673F8AB26D5BA6BF12970845047FBB4AA6935E60C1DD270CF1836F018B51F23
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f5a5fc6267f1ec0264a061702e6850a2.exe
Verdict:
Malicious activity
Analysis date:
2021-02-08 07:14:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e6d8e16b-b8b3-4cfb-abd5-e7061931d3d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/116010/
Detection(s):
SecuriteInfo.com.ArtemisF5A5FC6267F1.57.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/601524
Signature
.NET source code contains very large array initializations
Binary contains a suspicious time stamp
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 349781 Sample: nAo0tS1HgA.exe Startdate: 08/02/2021 Architecture: WINDOWS Score: 100 49 mail.devxico.com 2->49 59 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->59 61 Found malware configuration 2->61 63 Sigma detected: Scheduled temp file as task from temp location 2->63 65 8 other signatures 2->65 8 nAo0tS1HgA.exe 6 2->8         started        12 UTCCf.exe 5 2->12         started        14 UTCCf.exe 4 2->14         started        signatures3 process4 file5 41 C:\Users\user\AppData\...\rxhvBokWGptoxr.exe, PE32 8->41 dropped 43 C:\Users\user\AppData\Local\...\tmpF8D0.tmp, XML 8->43 dropped 45 C:\Users\user\AppData\...\nAo0tS1HgA.exe.log, ASCII 8->45 dropped 67 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->67 69 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->69 71 Injects a PE file into a foreign processes 8->71 16 nAo0tS1HgA.exe 2 9 8->16         started        21 schtasks.exe 1 8->21         started        73 Machine Learning detection for dropped file 12->73 23 schtasks.exe 12->23         started        25 UTCCf.exe 12->25         started        27 schtasks.exe 14->27         started        29 UTCCf.exe 14->29         started        signatures6 process7 dnsIp8 47 mail.devxico.com 162.241.2.107, 49744, 49745, 49746 OIS1US United States 16->47 37 C:\Users\user\AppData\Roaming\...\UTCCf.exe, PE32 16->37 dropped 39 C:\Users\user\...\UTCCf.exe:Zone.Identifier, ASCII 16->39 dropped 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->51 53 Tries to steal Mail credentials (via file access) 16->53 55 Tries to harvest and steal ftp login credentials 16->55 57 3 other signatures 16->57 31 conhost.exe 21->31         started        33 conhost.exe 23->33         started        35 conhost.exe 27->35         started        file9 signatures10 process11
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/15117a98b97b3b6c7b976692a0878f4f0031497a5ff7907e88fa9c68509428a5/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 07:12:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cuixvgfzpm5wy64xm2jkbb4pj4adcsl2l73za7ui7kogqueufcsq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
035cee889cc9c375316d63cb81b20184e2df56c817e174bd9863eeae55760e15
AgentTesla
3377e29fccab3c1d455fff935e95d6f1539b83eab04ea7c4115898bf3eb509dc
AgentTesla
57f501264360e52cdc77696ff96c77b47ecad9ceb41cd0210cf2f3809bebafc8
AgentTesla
5ed0a1eb2ec9b7d30cd842ef6fd6ca94befa246f096074d8a9bf0e699f11a076
AgentTesla
61ee96373bea7a259e498df91ca0ac4be13c0b130d85ea5efab91846c5cc9b79
AgentTesla
6a934b20446607ad0c87d491c2be3949a7a93b8bb89998cd31b64f4e76f819d7
AgentTesla
8392af9cff73aab10a60befd359d4ca2638d6a936071285579147303bb453497
AgentTesla
8d1be0410012fd27b21d5f1324f5ba1fc8b86ecc2d83dc9d4d24e25ad28d46f8
AgentTesla
8e8910ed69fa08f84d83829aa7c68e97ab862aa551199df0b98c5ce31a49f519
AgentTesla
bc2cc312ba11b1945f2fc371ddc960e24ae3fa9cf9117e51d8efa152b8bee2c8
AgentTesla
+ 2'481 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence ransomware spyware stealer trojan
Link:
https://tria.ge/reports/210208-74lrx84ama/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
2ec41720b412f91f91daaefea38007449491b2c016238aa8f23b6866c89bc788
MD5 hash:
987ce346069cf47535e5ac57265c7228
SHA1 hash:
d0085325ed78fcac6d1f605753237abd1c40db22
Link:
https://www.unpac.me/results/73f17617-53e3-498e-9b37-cca8cd874b81/
SH256 hash:
12af89161fe60b39de4b2766de933a71ecc46275e9a053f48493884e57e0ff2b
MD5 hash:
9169142f447032188123d3d3f9bc05f2
SHA1 hash:
a50a5d49642ba7c1b295cae5003ee4db58dfcf23
Link:
https://www.unpac.me/results/73f17617-53e3-498e-9b37-cca8cd874b81/
SH256 hash:
8ac2c7e1479135982ee6ab7f26cef22e9cefa4b223c7c15bd719936fa585b069
MD5 hash:
8c4c13e334226e15e2f29fee623e1a13
SHA1 hash:
7ee9d5b53e428fe9081fb08df35c7fdd89b1d0f6
Link:
https://www.unpac.me/results/73f17617-53e3-498e-9b37-cca8cd874b81/
SH256 hash:
15117a98b97b3b6c7b976692a0878f4f0031497a5ff7907e88fa9c68509428a5
MD5 hash:
f5a5fc6267f1ec0264a061702e6850a2
SHA1 hash:
681ef1d8a11d864ae6ba6f4cd3cdf7d1c8d3913c
Link:
https://www.unpac.me/results/73f17617-53e3-498e-9b37-cca8cd874b81/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/15117a98b97b3b6c7b976692a0878f4f0031497a5ff7907e88fa9c68509428a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 15117a98b97b3b6c7b976692a0878f4f0031497a5ff7907e88fa9c68509428a5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/994739/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116010/

Comments