MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1912f5c4fd7d4edda44d4e7a0db0b04329ac31103c3fb4b23030dbb9758d4b85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 12

Maldoc score: 17

Intelligence 12 IOCs YARA 6 File information Comments

SHA256 hash:	1912f5c4fd7d4edda44d4e7a0db0b04329ac31103c3fb4b23030dbb9758d4b85
SHA3-384 hash:	4f40619c1d923117788b7940a49e7e013fcd8a5c721aaccfdb985f66be07f2f4830edaa4141d1380bbf5ac1af636e905
SHA1 hash:	33739b475fcf1319cec2007ca7e8a05d98e4cd6a
MD5 hash:	f3fdc3313e3d18976fc1645f0e4ecd2c
humanhash:	cold-moon-october-glucose
File name:	INTERNATIONAL PHARMA LABS PRODUCT .xlsm
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	736'282 bytes
First seen:	2023-01-23 18:32:22 UTC
Last seen:	Never
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	12288:w9yIS1W2v1XJGMO40rS85YZ/457cqCkvfqfuppdOBWtrWbJn/tz+219iiULFc/zN:whSH1Xw5rt5XcqCkvCfuppdtV0VFr/hp
TLSH	T1E4F433BE8064CBC3FD27C4108C92AA20A96E01D849B5D5AF89B0D25DF3D86D8F15937B
TrID	42.2% (.XLAM) Excel Macro-enabled Open XML add-in (83500/1/13) 29.1% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12) 17.2% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7) 8.8% (.ZIP) Open Packaging Conventions container (17500/1/4) 2.0% (.ZIP) ZIP compressed archive (4000/1)
Reporter	abuse_ch
Tags:	AgentTesla xlsm

abuse_ch

Payload URL:
http://3.65.2.139/read/Phdymmrmanm.exe

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 17

OLE dump

MalwareBazaar was able to identify 7 sections in this file using oledump:

Section ID	Section size	Section name
A1	474 bytes	PROJECT
A2	62 bytes	PROJECTwm
A3	169 bytes	VBA/Sheet1
A4	633 bytes	VBA/ThisWorkbook
A5	7 bytes	VBA/_VBA_PROJECT
A6	209 bytes	VBA/dir

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Workbook_Open	Runs when the Excel Workbook is opened
IOC	3.65.2.139	IPv4 address
IOC	Phdymmrmanm.exe	Executable file name
Suspicious	Shell	May run an executable file or a system command
Suspicious	WScript.Shell	May run an executable file or a system command
Suspicious	powershell	May run PowerShell commands
Suspicious	executionpolicy	May run PowerShell commands
Suspicious	Start-Process	May run an executable file or a system command using PowerShell
Suspicious	CreateObject	May create an OLE object
Suspicious	Exec	May run an executable file or a system
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

242

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

INTERNATIONAL PHARMA LABS PRODUCT .xlsm

Verdict:

Malicious activity

Analysis date:

2023-01-23 18:35:17 UTC

Tags:

macros macros-on-open loader

Link:

https://app.any.run/tasks/aa89260e-3098-4012-9d21-92953b003202

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

File type:

application/vnd.ms-excel.sheet.macroEnabled.12

Has a screenshot:

False

Contains macros:

True

Detection:

zgRAT

Link:

https://www.capesandbox.com/analysis/356016/

Detection(s):

SecuriteInfo.com.Office.Macro-13.UNOFFICIAL

TwinWave.EvilDoc.PublicDottedQuadDLrRunLikeHell.20210223.UNOFFICIAL

Xls.Dropper.EPPlus-9802867-2

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Launching a process by exploiting the app vulnerability

Result

Verdict:

Malicious

File Type:

Excel File with Macro

Link:

https://app.docguard.net/1912f5c4fd7d4edda44d4e7a0db0b04329ac31103c3fb4b23030dbb9758d4b85/results/dashboard

Payload URLs

URL

File name

3.65.2.139

ThisWorkbook

Behaviour

BlacklistAPI detected

Document image

Image:

Download PNG

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

macros macros-on-open packed

Link:

https://www.filescan.io/uploads/63ced2df447edb203a006e76/reports/2de56229-9e6d-40e0-98f7-67457f7da8c3/overview

Label:

Malicious

Suspicious Score:

9.9/10

Score Malicious:

99%

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=c52b4c1e-f30c-40db-83be-6084b57dd725

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/1912f5c4fd7d4edda44d4e7a0db0b04329ac31103c3fb4b23030dbb9758d4b85

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

IPv4 Dotted Quad URL

A URL was detected referencing a direct IP address, as opposed to a domain name.

Hidden Powershell

Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.

Powershell in Macro

Detected a macro that may utilize Powershell. Such pivots are commonly found in malware.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Malicious Scriptlet 7 of 7

Detected a malicious pivot typically seen during the 'file-less' pivot commonly seen in malware carriers.

Document With No Content

Document contains little or no semantic information.

Result

Threat name:

AgentTesla, zgRAT

Detection:

malicious

Classification:

expl.evad.troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1157275

Signature

Antivirus / Scanner detection for submitted sample

Bypasses PowerShell execution policy

Document contains an embedded VBA macro with suspicious strings

Document exploit detected (process start blacklist hit)

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Powershell drops PE file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected AgentTesla

Yara detected Costura Assembly Loader

Yara detected Telegram RAT

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1912f5c4fd7d4edda44d4e7a0db0b04329ac31103c3fb4b23030dbb9758d4b85/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dejplrh5pvhn3jcnjz5a3mfqimu2ymiqhq73jmrqgdn3s5mnjocq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

collection macro persistence spyware stealer

Link:

https://tria.ge/reports/230123-w665sagc2y/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Process spawned unexpected child process

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1912f5c4fd7d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1912f5c4fd7d4edda44d4e7a0db0b04329ac31103c3fb4b23030dbb9758d4b85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time