MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15a5b08b916245fd666e172d308831ef96e4c68b63c9a0c57aa9b83519ebbf35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15a5b08b916245fd666e172d308831ef96e4c68b63c9a0c57aa9b83519ebbf35
SHA3-384 hash: f8067be75aee913650268eedaeecb7ade782c01206cf700cf07649fee519af0bd4ccbe59aa4b62e0d52a19d6882c0497
SHA1 hash: 27e65b93321224f683cab483fb136427795662be
MD5 hash: d61e2bca2c69bac7c76cee87763ceda4
humanhash: saturn-glucose-virginia-chicken
File name:TT COPY.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:607'744 bytes
First seen:2021-08-23 18:17:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:bIpywOCHkg02/xsRGkKpesqC+n7isASP6:SHkISRGkKyCQH5i
Threatray 8'793 similar samples on MalwareBazaar
TLSH T1F4D4E7012AFC541AE0A1F0375B17CD27466F298FD2F0C681954AF96FA933AB24B5C5CB
dhash icon 0092e4ace4f2b210 (3 x AgentTesla)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
337
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TT COPY.exe
Verdict:
Malicious activity
Analysis date:
2021-08-23 18:20:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c854c619-1fc3-4ecf-985b-fe28e34b5793

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/181604/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader41.25419.8037.15218.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/adc2d1cb-45d1-4dee-8437-bd85cdd36735
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/837762
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 470194 Sample: TT COPY.exe Startdate: 23/08/2021 Architecture: WINDOWS Score: 100 36 Found malware configuration 2->36 38 Multi AV Scanner detection for dropped file 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 8 other signatures 2->42 7 TT COPY.exe 6 2->7         started        10 tKZVPq.exe 2 2->10         started        12 tKZVPq.exe 1 2->12         started        process3 file4 26 C:\Users\user\AppData\...\dDXYrGmKpHUuR.exe, PE32 7->26 dropped 28 C:\Users\user\AppData\Local\Temp\tmp9C1.tmp, XML 7->28 dropped 30 C:\Users\user\AppData\...\TT COPY.exe.log, ASCII 7->30 dropped 14 RegSvcs.exe 2 4 7->14         started        18 schtasks.exe 1 7->18         started        20 conhost.exe 10->20         started        22 conhost.exe 12->22         started        process5 file6 32 C:\Users\user\AppData\Roaming\...\tKZVPq.exe, PE32 14->32 dropped 34 C:\Windows\System32\drivers\etc\hosts, ASCII 14->34 dropped 44 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->46 48 Modifies the hosts file 14->48 50 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->50 24 conhost.exe 18->24         started        signatures7 process8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/15a5b08b916245fd666e172d308831ef96e4c68b63c9a0c57aa9b83519ebbf35/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-23 14:24:45 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cws3bc4rmjc72ztoc4wtbcbr56lojrulmpe2brl2vg4dkgplx42q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0dea09c30d8e850fab893b3f17f9bad6898c7e77bb690ecfe523681ca0f07e95
AgentTesla
3ff22d53dcd6fdfdd65267fde69b10122c3c680d23334f2f9c6047768d823cfe
AgentTesla
6c774012ef6641580ad729f00e565e5ab5a13e7eeca97b510f2e2e9e101b9375
AgentTesla
71e6c949b0e259018b39ad513305c9197afe74c9d68119db8e6e545c74ceedcb
AgentTesla
790b008421852f555794a5e59c91f894993dcac641104ca06087bda8c1b5ea50
AgentTesla
9662d1e4c72efe73a1f203ebead6069990342a4da6314737e3a02b08e2d68075
AgentTesla
a3aa3605c436f4ef38f404007ce0305562def1f6e77f244232671b10914894f0
AgentTesla
b8e4c54f15ac8fc84223e2460f6201401c960851b4006d61360caa57c34af3ed
AgentTesla
d375f6f780b9623c85714c9fadae46359a8e308bdeaee7e2161a86c0a89c7d06
AgentTesla
da33725694fafe69b0a72478a9741ae2eac9d294966f160204a93e27f711b514
AgentTesla
+ 8'783 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210823-z1hcv16gka/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/8f778313-afa9-43c5-822a-f2f34f1a0483/
SH256 hash:
4a9611dbbcb2508dd2db1211012bae7140045ba4066573e14b458bd27dd3e4de
MD5 hash:
a698232cea34c69d6907ba818b61217a
SHA1 hash:
30baeff7a05fbf50f954a4a7df40c18f64af1b38
Link:
https://www.unpac.me/results/8f778313-afa9-43c5-822a-f2f34f1a0483/
SH256 hash:
52e1f01462b5684ac426f6715e76cfb4c4ab91af44ed7843f17c4cb92c689e75
MD5 hash:
94bca95d17017e0ab3563f9980985645
SHA1 hash:
248e27e9fd4acaea245b715cedfbea7ba6110888
Link:
https://www.unpac.me/results/8f778313-afa9-43c5-822a-f2f34f1a0483/
SH256 hash:
15a5b08b916245fd666e172d308831ef96e4c68b63c9a0c57aa9b83519ebbf35
MD5 hash:
d61e2bca2c69bac7c76cee87763ceda4
SHA1 hash:
27e65b93321224f683cab483fb136427795662be
Link:
https://www.unpac.me/results/8f778313-afa9-43c5-822a-f2f34f1a0483/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/15a5b08b9162/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/15a5b08b916245fd666e172d308831ef96e4c68b63c9a0c57aa9b83519ebbf35

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 15a5b08b916245fd666e172d308831ef96e4c68b63c9a0c57aa9b83519ebbf35

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/181604/

Comments