MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc
SHA3-384 hash:	b7ab1b3027ec0f83e536555d54d61517101b74617b1242b7ee191e88288c2c8faf574f037742ba5b101220c3f3cc7196
SHA1 hash:	6f7bf5b871e413f40f1c23e7953251d0fabbbf95
MD5 hash:	eff515cd80fca123c65f7ed20d7f071f
humanhash:	georgia-chicken-ceiling-spring
File name:	HWX.vbs
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	275'722 bytes
First seen:	2023-08-31 13:12:53 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	6144:t7jmLQQJm7ILm5BmZMLpRKsEAlOb4b5bdZ7ZmZ8Z7V:t7jmLQQJm7ILm5BmZMLp4sEAT
Threatray	5'470 similar samples on MalwareBazaar
TLSH	T11144C11121DAA04CB273BF835BCD75E99F5BF7B22B2A187E242803179722D54CE69731
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	James_inthe_box
Tags:	AgentTesla vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/445475/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfuscated-JK.12882.885.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

sload

Link:

https://www.filescan.io/uploads/64f091df7444d2eb09f40e12/reports/4770b9ab-5023-4561-9335-d3340c6e6e12/overview

Hybrid Analysis Trojan.Script.Hworm

Verdict:

Suspicious

Labled as:

Trojan.Script.Hworm

Link:

https://www.hybrid-analysis.com/sample/26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1301049

Signature

Antivirus detection for URL or domain

Drops VBS files to the startup folder

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Drops script at startup location

Sigma detected: Powershell download and load assembly

Sigma detected: RegAsm connects to smtp port

Snort IDS alert for network traffic

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Minerva

Threat name:

Script-WScript.Trojan.Minerva

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-08-31 13:12:49 UTC

File Type:

Text (VBS)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eylwebjbd7oopljuz4inolyxr4len2it4nupb5n4yms6kquknhga._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

3f92752540e0658dc96fef662e8f96f9552383c8b8da50ea7707b35727a645de

AgentTesla

60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623

AgentTesla

a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509

AgentTesla

b9a72ccaad2c22150062d59d79744e1ab3aa5a106aa0837bdde9e05ccb39c91e

AgentTesla

be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf

AgentTesla

d62a3c103767f15ab470a20b591eb58d278cd500b5bf53bec7b3cca327f71c21

AgentTesla

d7093e702ca2995bfe864781a9476419a95efcd51d29805ce721021da24e4e94

AgentTesla

e9030808d9eb24aba0aa124faebeecaa515b498d738bdb30414af6a15dc98120

AgentTesla

f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf

AgentTesla

+ 5'460 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230831-qf3rsafc37/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Drops startup file

Blocklisted process makes network request

Malware Config

Dropper Extraction:

https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI AgentTesla

Threat name:

AgentTesla

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Delivery method

Other

Cape

https://www.capesandbox.com/analysis/445475/

  

URLhaus

https://urlhaus.abuse.ch/url/2708639/