MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15189732a875a6464e53bee90a29e181cd6bf8420b8b7a86f0cafd36e9e86a44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15189732a875a6464e53bee90a29e181cd6bf8420b8b7a86f0cafd36e9e86a44
SHA3-384 hash: 0bea175e93f6f9c6476e5c3943b3797cf529eec0e673664bf48c901fc9eb6afe834054b93eb4a3ba211fbfdb83de8943
SHA1 hash: 02e5f0b35ad4caec4ebb6ae25b4ae5e155a78af7
MD5 hash: c16b00d793de82af17d09f4719610739
humanhash: muppet-arkansas-hydrogen-thirteen
File name:PO_LRTC17086.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:762'880 bytes
First seen:2021-07-08 05:36:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'475 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:UFRq5WxxJ41vLjxDU40CAiBorjZqEAOLCoxRDspNYHQICeWRUmbqPlMLaAjWN+ew:/uxm1vHpUJi2rjrLCozAQrBWR36N
Threatray 6'444 similar samples on MalwareBazaar
TLSH T1A5F46BBD313275EECDABC6388B742D6C9F5872BBD20B2272501B6469448CE978F61473
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO_LRTC17086.exe
Verdict:
Malicious activity
Analysis date:
2021-07-08 05:39:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3470dee8-2c1a-4f7d-9d20-c8fda923fcc2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170339/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.908-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6066fb09-da94-4817-bcf6-680100de74ed
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/813256
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/15189732a875a6464e53bee90a29e181cd6bf8420b8b7a86f0cafd36e9e86a44/
Threat name:
ByteCode-MSIL.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-07-08 01:13:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cumjomviowtemtstx3uqukpbqhgwx6ccbofxvbxqzl6tn2pinjca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
48ec76cfb4b4ea2605a727eeb7314f5b724969764ce02b7e6937211948c5ccfe
AgentTesla
547a7ac157fcd43b2ed1d1468e8076af6393b28a7ce4e447e3ca665c93c677f8
AgentTesla
88d6342ccae8c8af4195bcb8c8d41230821ff2d1d5d559e074e240d903af840d
AgentTesla
96e88a52bedfff7b7270c805e1e3e3069a3d4111210a6f568d37e9a9e0ebc88d
AgentTesla
ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def
AgentTesla
b8aa0bc71ba600e39afa9e612cff8216020c9d276df9655c6d9d807ef3b18bc9
AgentTesla
cc3f2040e16deb0a3a03c1c188b9ddf91b1caf746a4c8ebb1cc99c2ffda198ce
AgentTesla
d40555c64312025571d9eb3eb64c0d3267f9672f4e8794e378db09d72a192e9f
AgentTesla
d8e273754006eb7118be058c46efef0a1b20ae4929dad75ecfed1ae1aae0c0eb
AgentTesla
e6ce317d3368fb336f2d2efb78002797975ba82ba0a16869b5e2912caf5731c6
AgentTesla
+ 6'434 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210708-dhnjsf9msn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
459499fffb4bdb6964b6f149043e3924bb2932a4e1b88918f9babbe41d09ee21
MD5 hash:
a077da2b11d9122c5ecc25bcbe9511f2
SHA1 hash:
2d53f1a1eecdd82cde1f792b60045cfe07378095
Link:
https://www.unpac.me/results/2bbd7256-bcd7-4bc0-8dc5-476fcbe3ca8c/
SH256 hash:
a970ec56341494d2dc6b1519a584686147e49d0dff2902aa7d3830b8940479ee
MD5 hash:
8bc5d9bf86d3c11be2ed461b686d81e2
SHA1 hash:
2c4a3658d85e620940d58a7fcd74fa84a2f6cc29
Link:
https://www.unpac.me/results/2bbd7256-bcd7-4bc0-8dc5-476fcbe3ca8c/
SH256 hash:
5209992fd1f96cd1959efb5e1afa71f5c9ae2ab4430e258fe9d0ec915098d110
MD5 hash:
257ca10e5cbb2f8bdf0ae6f3e900e11e
SHA1 hash:
9d25ee80dbe3bbce5ab4479912c5e21b19b6aeec
Link:
https://www.unpac.me/results/2bbd7256-bcd7-4bc0-8dc5-476fcbe3ca8c/
SH256 hash:
15189732a875a6464e53bee90a29e181cd6bf8420b8b7a86f0cafd36e9e86a44
MD5 hash:
c16b00d793de82af17d09f4719610739
SHA1 hash:
02e5f0b35ad4caec4ebb6ae25b4ae5e155a78af7
Link:
https://www.unpac.me/results/2bbd7256-bcd7-4bc0-8dc5-476fcbe3ca8c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/15189732a875a6464e53bee90a29e181cd6bf8420b8b7a86f0cafd36e9e86a44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ffaa83970c7e63b1170180e13182f12de2db59777deb86d40c268c02cad2fe9d

AgentTesla

Executable exe 15189732a875a6464e53bee90a29e181cd6bf8420b8b7a86f0cafd36e9e86a44

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 ffaa83970c7e63b1170180e13182f12de2db59777deb86d40c268c02cad2fe9d
Cape
Cape
https://www.capesandbox.com/analysis/170339/

Comments