MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Maldoc score: 4


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa
SHA3-384 hash: 3e489fcdf48cb2219f7a9088c88e5c8c32bca5a703eba1ef25c97dc1f96a6866de8f42ded0d27b1952e6789697517556
SHA1 hash: ba4c6674793a16f44f36b6a1f3eea6203887a838
MD5 hash: c4eed748b432c0b3b6f95dd654725d0b
humanhash: freddie-timing-oklahoma-kansas
File name:SC_TR20240619.xls
Download: download sample
Signature AgentTesla
Create hunting rule
File size:329'216 bytes
First seen:2024-06-19 11:29:02 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 6144:0uyqFzL5LIT47H0N/JNj7ECKStnwkHHg8eTxAcMpV5yVLpZ4q4Vxk:0uyqFzu4L0N/JNspSx/HVeqcM7YVLsk
TLSH T13A641254F691CB67E01390BC1AECA0E74709FDE17E46CD0A30527BCE0236F995EA7A16
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:AgentTesla xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 4
OLE dump

MalwareBazaar was able to identify 15 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
2244 bytesDocumentSummaryInformation
3200 bytesSummaryInformation
499 bytesMBD00073A8B/CompObj
5135624 bytesMBD00073A8B/Package
6556 bytesMBD00073A8C/Ole
7176288 bytesWorkbook
8533 bytes_VBA_PROJECT_CUR/PROJECT
9104 bytes_VBA_PROJECT_CUR/PROJECTwm
10977 bytes_VBA_PROJECT_CUR/VBA/Sheet1
11977 bytes_VBA_PROJECT_CUR/VBA/Sheet2
12977 bytes_VBA_PROJECT_CUR/VBA/Sheet3
13985 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
142644 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
15553 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
357
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa.xls
Verdict:
Malicious activity
Analysis date:
2024-06-19 11:45:03 UTC
Tags:
phishing phishing-xls
Link:
https://app.any.run/tasks/80c55fa8-ff20-46b8-8aaa-1b53eb214e3b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
application/vnd.ms-excel
Has a screenshot:
False
Contains macros:
False
Detection(s):
TwinWave.EvilDoc.93TilInfinity.20240412.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.IMG.Phish.20422.21836.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PDF.Phisher.666.32461.992.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6672c2fd89a0563951ff1f8ewin10vpnfull_triage
Tags:
Generic Infostealer Office Phish
Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Creating a window
DNS request
Sending an HTTP GET request
Searching for synchronization primitives
Launching a process
Сreating synchronization primitives
Connection attempt by exploiting the app vulnerability
Sending a custom TCP request by exploiting the app vulnerability
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa/results/dashboard
Payload URLs
URL
File name
http://gf.to/vwambNPxk
Embedded Ole
Behaviour
SuspiciousRTF detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
macros
Link:
https://www.filescan.io/uploads/6672c13beae3878d8f3a5237/reports/7411f63c-3cbf-49c7-a41a-532a20e2aaf2/overview
Verdict:
Malicious
Labled as:
Msoffice/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa
Label:
Benign
Suspicious Score:
1.7/10
Score Malicious:
18%
Score Benign:
82%
Link:
https://www.malware.ai/gui/files/?id=56933cb5-68ae-4103-bd53-0a2d840d85ca
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa
Details
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1459458
Signature
AI detected suspicious Excel or Word document
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Check if machine is in data center or colocation facility
Connects to a pastebin service (likely for C&C)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs new ROOT certificates
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Microsoft Office drops suspicious files
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: Equation Editor Network Connection
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell download and load assembly
Sigma detected: Powershell download payload from hardcoded c2 list
Sigma detected: RegAsm connects to smtp port
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic
Suspicious execution chain found
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AgentTesla
Yara detected Generic Downloader
Yara detected Powershell download and execute
Yara detected VBS Downloader Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1459458 Sample: SC_TR20240619.xls Startdate: 19/06/2024 Architecture: WINDOWS Score: 100 58 gf.to 2->58 76 Snort IDS alert for network traffic 2->76 78 Multi AV Scanner detection for domain / URL 2->78 80 Found malware configuration 2->80 82 27 other signatures 2->82 9 wscript.exe 11 2->9         started        13 WINWORD.EXE 337 37 2->13         started        16 EXCEL.EXE 30 42 2->16         started        18 EXCEL.EXE 2->18         started        signatures3 process4 dnsIp5 66 paste.ee 9->66 68 uploaddeimagens.com.br 188.114.97.3, 443, 49176, 49177 CLOUDFLARENETUS European Union 9->68 100 System process connects to network (likely due to code injection or exploit) 9->100 102 Suspicious powershell command line found 9->102 104 Wscript starts Powershell (via cmd or directly) 9->104 114 4 other signatures 9->114 20 powershell.exe 4 9->20         started        46 C:\Users\user\AppData\...\vwambNPxk.url, MS 13->46 dropped 48 C:\Users\user\AppData\Roaming\...\gf.to.url, MS 13->48 dropped 50 ~WRF{EAB11382-BA99...3-7237DFDBFE16}.tmp, Composite 13->50 dropped 52 C:\Users\user\AppData\Local\...\1B7A8570.doc, Rich 13->52 dropped 106 Microsoft Office launches external ms-search protocol handler (WebDAV) 13->106 108 Office viewer loads remote template 13->108 110 Microsoft Office drops suspicious files 13->110 23 EQNEDT32.EXE 12 13->23         started        70 gf.to 104.21.26.96, 443, 49164, 49165 CLOUDFLARENETUS United States 16->70 72 23.95.235.16, 49166, 49174, 49175 AS-COLOCROSSINGUS United States 16->72 54 C:\Users\user\...\SC_TR20240619.xls (copy), Composite 16->54 dropped 56 C:\Users\user\AppData\Local\...\ugc[1].doc, Rich 16->56 dropped 26 DW20.EXE 16->26         started        28 AcroRd32.exe 20 16->28         started        file6 112 Connects to a pastebin service (likely for C&C) 66->112 signatures7 process8 file9 84 Suspicious powershell command line found 20->84 86 Suspicious execution chain found 20->86 30 powershell.exe 12 5 20->30         started        42 C:\...\lionsarejunglelivingalwaysther.vBs, Unicode 23->42 dropped 44 C:\...\lionsarejunglelivingalwaysthere[1].bmp, Unicode 23->44 dropped 88 Office equation editor establishes network connection 23->88 90 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 23->90 34 DWWIN.EXE 4 26->34         started        signatures10 process11 dnsIp12 74 uploaddeimagens.com.br 30->74 116 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 30->116 118 Writes to foreign memory regions 30->118 120 Injects a PE file into a foreign processes 30->120 36 RegAsm.exe 30->36         started        40 EXCEL.EXE 34->40         started        signatures13 process14 dnsIp15 60 mail.alitextile.com 192.185.143.105, 49182, 49183, 587 UNIFIEDLAYER-AS-1US United States 36->60 62 ip-api.com 208.95.112.1, 49181, 80 TUT-ASUS United States 36->62 64 3 other IPs or domains 36->64 92 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 36->92 94 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 36->94 96 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 36->96 98 5 other signatures 36->98 signatures16
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbtjiehe7i3i2ovkmlsl5sawsz633zglera3nh2lfy3fxz2eh35a._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/240619-nl53zstfnp/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in System32 directory
Abuses OpenXML format to download file from external location
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d340831e-b5c4-497f-94d7-f00ad58d9bc1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/08669410e4fa368d3aaa62e4bec816967dbde4cb2441b69f4b2e365be7443efa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:office_document_vba
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Office document with embedded VBA
Reference:https://github.com/jipegit/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments