MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 541d2b3f34842b415901f2a40880b3fd44344b5ac7d78c991ee11456ae88e30a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Maldoc score: 7


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 541d2b3f34842b415901f2a40880b3fd44344b5ac7d78c991ee11456ae88e30a
SHA3-384 hash: e7d228bdd0c821b1058fccd2a6bd659d165a920f6a4e12c3a2dec5b332f8122db45e9837e986e346f2bbb3afa726b4f1
SHA1 hash: 29c65607ca8b9c11514bdb9c8bc2cf34eb933414
MD5 hash: 0777bf7020b78d26af996298be5093db
humanhash: may-six-indigo-king
File name:ENS003.xls
Download: download sample
Signature AgentTesla
Create hunting rule
File size:155'136 bytes
First seen:2020-12-08 16:33:37 UTC
Last seen:2020-12-08 18:51:45 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 3072:21k3hbdlylKsgqopeJBWhZFGkE+cL2NdAPAjD7lc2OYUTtBRnm+awRXJpe5Wn3Os:Kk3hbdlylKsgqopeJBWhZFVE+W2NdAPb
TLSH C7E3CE567383D646EE880B324EE6D1DAB772FC017E26420776D4B76F1E742A4CD12E22
Reporter abuse_ch
Tags:AgentTesla xls


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: STEELMET ROMANIA SA <office@poolalighting.com>
Subject: new offer
Attachment: ENS003.xls

AgentTesla payload URL:
http://mokiastrade.com/seal/oat.exe

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 7
Application name is Microsoft Excel
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 16 sections in this file using oledump:

Section IDSection sizeSection name
1108 bytesCompObj
2256 bytesDocumentSummaryInformation
3200 bytesSummaryInformation
4131902 bytesWorkbook
5521 bytes_VBA_PROJECT_CUR/PROJECT
6113 bytes_VBA_PROJECT_CUR/PROJECTwm
7991 bytes_VBA_PROJECT_CUR/VBA/Sheet1
8991 bytes_VBA_PROJECT_CUR/VBA/Sheet2
93215 bytes_VBA_PROJECT_CUR/VBA/TNcBzChRU
102342 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
113244 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
121842 bytes_VBA_PROJECT_CUR/VBA/__SRP_0
13198 bytes_VBA_PROJECT_CUR/VBA/__SRP_1
141164 bytes_VBA_PROJECT_CUR/VBA/__SRP_2
15258 bytes_VBA_PROJECT_CUR/VBA/__SRP_3
16594 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_OpenRuns when the Excel Workbook is opened
Hex String1bvy7ty31627679377479
Hex StringDifp64469667036
SuspiciousShellMay run an executable file or a system command
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
2
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0777bf7020b78d26af996298be5093db
Verdict:
Malicious activity
Analysis date:
2020-12-09 00:38:39 UTC
Tags:
macros macros-on-open loader
Link:
https://app.any.run/tasks/27c68047-9e6f-481e-afbf-2417bf137723

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.BehavesLike.OLE2.Downloader.cb.18348.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/541d2b3f34842b415901f2a40880b3fd44344b5ac7d78c991ee11456ae88e30a/results/dashboard
Document image
Image:
Download PNG
Document image
Result
Verdict:
UNKNOWN
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/558211
Signature
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA with hexadecimal encoded strings
Document exploit detected (process start blacklist hit)
Drops PE files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Obfuscated command line found
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Powershell drops PE file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Microsoft Office Product Spawning Windows Shell
Very long command line found
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 328201 Sample: ENS003.xls Startdate: 08/12/2020 Architecture: WINDOWS Score: 100 82 Antivirus detection for URL or domain 2->82 84 Multi AV Scanner detection for submitted file 2->84 86 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->86 88 8 other signatures 2->88 9 EXCEL.EXE 57 13 2->9         started        12 BJFaPnLVS.exe 2->12         started        15 BJFaPnLVS.exe 1 2->15         started        17 3 other processes 2->17 process3 dnsIp4 96 Obfuscated command line found 9->96 98 Very long command line found 9->98 100 Document exploit detected (process start blacklist hit) 9->100 19 powershell.exe 16 9 9->19         started        76 hastebin.com 12->76 102 Injects a PE file into a foreign processes 12->102 24 BJFaPnLVS.exe 12->24         started        26 cmd.exe 12->26         started        78 hastebin.com 15->78 28 cmd.exe 15->28         started        30 BJFaPnLVS.exe 2 15->30         started        80 hastebin.com 17->80 32 cmd.exe 17->32         started        34 cmd.exe 17->34         started        36 cmd.exe 17->36         started        38 BJFaPnLVS.exe 17->38         started        signatures5 process6 dnsIp7 68 mokiastrade.com 95.181.152.221, 49169, 80 MSKHOSTRU Russian Federation 19->68 70 cutt.ly 104.22.0.232, 443, 49167 CLOUDFLARENETUS United States 19->70 64 C:\Users\user\AppData\Local\...\BJFaPnLVS.exe, PE32 19->64 dropped 90 Powershell drops PE file 19->90 40 BJFaPnLVS.exe 15 2 19->40         started        72 mail.privateemail.com 198.54.122.60, 49174, 49175, 587 NAMECHEAP-NETUS United States 24->72 45 timeout.exe 26->45         started        47 timeout.exe 28->47         started        49 timeout.exe 32->49         started        51 timeout.exe 34->51         started        file8 signatures9 process10 dnsIp11 74 hastebin.com 104.24.127.89, 443, 49170, 49171 CLOUDFLARENETUS United States 40->74 66 C:\Users\user\AppData\...\BJFaPnLVS.exe, PE32 40->66 dropped 104 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 40->104 106 Creates an undocumented autostart registry key 40->106 108 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 40->108 110 4 other signatures 40->110 53 cmd.exe 40->53         started        56 BJFaPnLVS.exe 2 40->56         started        58 BJFaPnLVS.exe 40->58         started        60 BJFaPnLVS.exe 40->60         started        file12 signatures13 process14 signatures15 92 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 53->92 94 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 53->94 62 timeout.exe 53->62         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/541d2b3f34842b415901f2a40880b3fd44344b5ac7d78c991ee11456ae88e30a/
Threat name:
Script.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 15:58:15 UTC
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kqoswpzuqqvucwib6ksaraft7vcdis22y7lyzgi64ekfnlui4mfa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro persistence spyware
Link:
https://tria.ge/reports/201208-cc6asxmdkn/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Delays execution with timeout.exe
Office loads VBA resources, possible macro or embedded object present
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
Process spawned unexpected child process
Modifies WinLogon for persistence
Malware Config
Dropper Extraction:
https://cutt.ly/phEd17l
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/541d2b3f34842b415901f2a40880b3fd44344b5ac7d78c991ee11456ae88e30a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Excel file xls 541d2b3f34842b415901f2a40880b3fd44344b5ac7d78c991ee11456ae88e30a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/899403/
  
Delivery method
Distributed via e-mail attachment

Comments