MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36714617ab3acacb11df096fb64e7ced344b241ebfdd501a60077c931c89577a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	36714617ab3acacb11df096fb64e7ced344b241ebfdd501a60077c931c89577a
SHA3-384 hash:	4d5662010d912c97a7152a86367e698dddbd7427495e351ec0149cdf5c902b6af2aed381c727f4a824f65a2313e76cef
SHA1 hash:	fffbc3ff7a20e9b5ce7cba314988f78feba8818e
MD5 hash:	0ab4c299c5cd500fb1ae69c2b3b449b9
humanhash:	massachusetts-september-july-december
File name:	Order.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	616'052 bytes
First seen:	2024-09-18 09:47:13 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:mMf1AA9a6oVwLkxbDt6P+B7Cg2KE073cN9mc9rf8FZ4UmlWT3GBBUUgn6QfCKUcj:lcVbdB7Uf/Ry
Threatray	3'452 similar samples on MalwareBazaar
TLSH	T10CD4B31135EAB04CF1F32FA357E965E98FBBB5622626512E7008134B4B63E90CE51B73
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	mp3
Reporter	JAMESWT_WT
Tags:	AgentTesla js pub-26ee9be236b54d0cb1b570a203543b93-r2-dev

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

407

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.25899.JsHeur.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66eaa1d45d6a2b58599aa279

Tags:

Encryption Execution Network Stealth Agent

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/66eaa1d33c9389b729b94d56/reports/47214ca3-df18-475b-92ea-3b3fbddcd966/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/36714617ab3acacb11df096fb64e7ced344b241ebfdd501a60077c931c89577a

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1513035

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell download and load assembly

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/36714617ab3acacb11df096fb64e7ced344b241ebfdd501a60077c931c89577a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/36714617ab3acacb11df096fb64e7ced344b241ebfdd501a60077c931c89577a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gzyumf5lhlfmweo7bfx3mtt45u2ewja6x7ovagtaa56jghejk55a._file

Threatray agenttesla agenttesla_v4

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

agenttesla_v4

Alert

Create hunting rule

Similar samples:

04f2e728cb9c631c92f2b9e03f69931910866269d8f4723d8e33d4eb124c45ec

AgentTesla

10389545eb87f012b182a11ca848bf055cd6777af672c48534a8a69e80727f1a

AgentTesla

1dd1b7dfae5bc447fde444e46f1251e1b8fb452419e7a29044a5f4d829f2a13f

AgentTesla

7b10095337e3dab2020d39ba05f903fdf8de72ae363367415745997f9ed037f9

AgentTesla

821b835cf408ed1749ad5723447b414e84cf453af621230e3dcb01f7be6a2495

AgentTesla

b9d904d9b7fc556f811409a6cba91e81bd165df86534240a903753fb3a5f3f3c

AgentTesla

c3553b74f24c673dfa6efde5ac44834cc6700b0b6d0cdc9089043803725ce8b7

AgentTesla

cac654b47278dd85f72e5886d9bf2571354e142961c892bca249a5fdc3d0183e

AgentTesla

f0b5526477fad1187160fb53453308498c84ac7a6fd3e5470cd3838d65afdbf8

AgentTesla

+ 3'442 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla credential_access discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240918-lsr4lavepk/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Credentials from Password Stores: Credentials from Web Browsers

AgentTesla

Malware Config

Dropper Extraction:

https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.