MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01237a328e0ba2a9be78b63b71a1594b1941a648951554f8feab62c47a13a08c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01237a328e0ba2a9be78b63b71a1594b1941a648951554f8feab62c47a13a08c
SHA3-384 hash: 43a342b212032d808309d3541b82bb394fa534d2dcfc6a238a32eb4a842793d2643b3153f0470d3eef574de3796e4e84
SHA1 hash: f102c3d7daf5064408936461187267ce02162afc
MD5 hash: f414f8883d69c1449bc9b595fb140615
humanhash: two-michigan-nevada-queen
File name:AWB.ppam
Download: download sample
Signature AgentTesla
Create hunting rule
File size:32'393 bytes
First seen:2021-12-02 08:53:44 UTC
Last seen:Never
File type:PowerPoint file ppam
MIME type:application/vnd.openxmlformats-officedocument.presentationml.presentation
ssdeep 768:pP3s2GNqUSx1UI+7FZzBqWC7u27rKGNQCeN64kObffV:pk2GEzxoPBqWZArKG2DN6mjV
TLSH T1A5E2E0E092E4F948D3179A37135DA2A4AC523235FFBABEA7F6D5735FC59A3401813104
Reporter abuse_ch
Tags:AgentTesla ppam

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.AutoTriggerEvilMrFantasyM3.20200721.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EvilMrFantasyIceIsNiceEdition.20200806.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.WhatItSoundsLikeWhenEncodersCry.20210216.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Legacy PowerPoint File with Macro
Link:
https://app.docguard.net/01237a328e0ba2a9be78b63b71a1594b1941a648951554f8feab62c47a13a08c/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
macros macros-on-open
Link:
https://www.filescan.io/uploads/61a889b2707a51cfe28af8c1/reports/97fb3a0a-3085-452e-bd27-593552a01404/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/01237a328e0ba2a9be78b63b71a1594b1941a648951554f8feab62c47a13a08c
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/899977
Signature
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Creates processes via WMI
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document exploit detected (process start blacklist hit)
Machine Learning detection for sample
Sigma detected: Change PowerShell Policies to a Unsecure Level
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious MSHTA Process Patterns
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Writes or reads registry keys via WMI
Writes registry values via WMI
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532452 Sample: AWB.ppam Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 52 Antivirus detection for dropped file 2->52 54 Machine Learning detection for sample 2->54 56 Document contains an embedded VBA with base64 encoded strings 2->56 58 8 other signatures 2->58 8 cmd.exe 1 2->8         started        10 WmiPrvSE.exe 3 2->10         started        13 taskeng.exe 1 2->13         started        15 8 other processes 2->15 process3 dnsIp4 18 POWERPNT.EXE 9 15 8->18         started        68 Creates autostart registry keys with suspicious values (likely registry only malware) 10->68 70 Creates multiple autostart registry keys 10->70 72 Creates an autostart registry key pointing to binary in C:\Windows 10->72 20 mshta.exe 1 25 13->20         started        48 www.starinxxxgkular.duckdns.org 142.251.40.228, 49179, 49187, 80 GOOGLEUS United States 15->48 50 www.google.com 172.217.168.68, 49180, 49181, 80 GOOGLEUS United States 15->50 signatures5 process6 dnsIp7 24 mshta.exe 4 13 18->24         started        36 blogspot.l.googleusercontent.com 172.217.168.1, 443, 49168, 49172 GOOGLEUS United States 20->36 38 accounts.google.com 172.217.168.45, 443, 49177 GOOGLEUS United States 20->38 40 6 other IPs or domains 20->40 34 C:\Users\user\AppData\Local\...\25[1].htm, HTML 20->34 dropped 28 powershell.exe 20->28         started        file8 process9 dnsIp10 42 j.mp 67.199.248.17, 443, 49165 GOOGLE-PRIVATE-CLOUDUS United States 24->42 44 download2263.mediafire.com 199.91.155.4, 443, 49167 MEDIAFIREUS United States 24->44 46 www.mediafire.com 104.16.202.237, 443, 49166 CLOUDFLARENETUS United States 24->46 60 Bypasses PowerShell execution policy 24->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 24->62 64 Creates processes via WMI 24->64 66 2 other signatures 24->66 30 powershell.exe 6 24->30         started        32 schtasks.exe 24->32         started        signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01237a328e0ba2a9be78b63b71a1594b1941a648951554f8feab62c47a13a08c/
Threat name:
Script-Macro.Downloader.SLoad
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 08:54:12 UTC
File Type:
Document
Extracted files:
15
AV detection:
21 of 43 (48.84%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aerxumuoborktptywy5xdikzjmmudjsisukvj6h6vnrmi6qtucga._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211202-ktwmqsdehq/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Blocklisted process makes network request
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Modifies Windows Firewall
AgentTesla Payload
AgentTesla
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/01237a328e0ba2a9be78b63b71a1594b1941a648951554f8feab62c47a13a08c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

PowerPoint file ppam 01237a328e0ba2a9be78b63b71a1594b1941a648951554f8feab62c47a13a08c

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments