MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e
SHA3-384 hash: c684f6fb92fc8cae94950260238415ffbb6f38666e96e3c4108be5f3c008c45687195b053334b689c168caf78b8b9192
SHA1 hash: 143fd3c85c8c4d1582f46e7dd1df66ec55a10662
MD5 hash: 916ebc98b5e558d1549670b6daaa69f5
humanhash: april-berlin-moon-gee
File name:nick015.docx
Download: download sample
Signature AgentTesla
Create hunting rule
File size:16'424 bytes
First seen:2024-07-15 11:58:19 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 384:3yXkT5jW9Zs8PL8wi4OEwH8TIbE91r2fRJJY+vigkZoCOkp:3ckVYZ5P3DOqnYJHLvVkZoop
TLSH T17D729E6F94D462ADD30B64F800023190F7E8A9A7B1BBB92EE3607A58C17559EC74075D
TrID 52.2% (.DOCX) Word Microsoft Office Open XML Format document (23500/1/4)
38.8% (.ZIP) Open Packaging Conventions container (17500/1/4)
8.8% (.ZIP) ZIP compressed archive (4000/1)
Reporter lowmal3
Tags:cve-2017-0199 doc

Intelligence

File Origin
# of uploads :
1
# of downloads :
2'636
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e.doc
Verdict:
Malicious activity
Analysis date:
2024-07-15 12:06:19 UTC
Tags:
cve-2017-0199 exploit
Link:
https://app.any.run/tasks/833d5e40-846e-46db-a70d-0200a7a17d0b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
application/msword
Has a screenshot:
False
Contains macros:
False
Detection(s):
TwinWave.EvilDoc.OkayLureDefenderWord.20220418.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30525.XmlHeur.UNOFFICIAL
Create hunting rule

Doc.Downloader.Loda-7570590-0
Create hunting rule

TwinWave.EvilDoc.RemoteTemplateCallBadDDomainShowdown.20200304.UNOFFICIAL
Create hunting rule

MiscreantPunch.Suspicious.RemoteTemplateCall.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66950f07cadc6250d05561cfwin7simulatehigh_evasion
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Connection attempt to an infection source by exploiting the app vulnerability
Creating a window
Creating a file
DNS request
Connection attempt
Sending a custom TCP request
Query of malicious DNS domain
Launching a process by exploiting the app vulnerability
Sending a TCP request to an infection source by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
OOXML Word File
Link:
https://app.docguard.net/5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
language-af masquerade
Link:
https://www.filescan.io/uploads/66950f1ce2844de972b2e6e2/reports/8db41cc1-c394-4784-8c68-3aa7b9139444/overview
Verdict:
Malicious
Labled as:
CVE-2017-0199
Link:
https://www.hybrid-analysis.com/sample/5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e
Label:
Malicious
Suspicious Score:
6.8/10
Score Malicious:
69%
Score Benign:
31%
Link:
https://www.malware.ai/gui/files/?id=54323501-da3e-4993-bd65-e1e6d7a4962a
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e
Details
External Relationship Element
Document contains an externally hosted relationship, which fetches further content.
Result
Threat name:
AgentTesla, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1473519
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains an external reference to another file
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Drops PE files with a suspicious file extension
Found malware configuration
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Microsoft Office drops suspicious files
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for dropped file
Office drops RTF file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Equation Editor Network Connection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Microsoft Office Child Process
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1473519 Sample: nick015.docx.doc Startdate: 15/07/2024 Architecture: WINDOWS Score: 100 60 covid19help.top 2->60 78 Found malware configuration 2->78 80 Malicious sample detected (through community Yara rule) 2->80 82 Antivirus detection for URL or domain 2->82 84 18 other signatures 2->84 9 WINWORD.EXE 313 54 2->9         started        14 taskeng.exe 1 2->14         started        signatures3 process4 dnsIp5 62 covid19help.top 104.21.83.128, 443, 49163, 49165 CLOUDFLARENETUS United States 9->62 64 172.67.175.222, 443, 49164, 49167 CLOUDFLARENETUS United States 9->64 52 C:\Users\user\AppData\...\nick.doc.url, MS 9->52 dropped 54 C:\Users\user\AppData\...\covid19help.top.url, MS 9->54 dropped 56 ~WRF{D4C03E65-6BF9...1-D1DD4757E907}.tmp, Composite 9->56 dropped 108 Microsoft Office launches external ms-search protocol handler (WebDAV) 9->108 110 Office viewer loads remote template 9->110 112 Microsoft Office drops suspicious files 9->112 16 EQNEDT32.EXE 11 9->16         started        21 TwqPuOzbnOG.exe 14->21         started        file6 signatures7 process8 dnsIp9 58 covid19help.top 16->58 44 C:\Users\user\AppData\Roaming\nick39100.scr, PE32 16->44 dropped 46 C:\Users\user\AppData\Local\...\nick[1].scr, PE32 16->46 dropped 66 Office equation editor establishes network connection 16->66 68 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 16->68 23 nick39100.scr 5 16->23         started        70 Multi AV Scanner detection for dropped file 21->70 72 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 21->72 74 Machine Learning detection for dropped file 21->74 76 2 other signatures 21->76 27 TwqPuOzbnOG.exe 21->27         started        29 powershell.exe 21->29         started        31 powershell.exe 21->31         started        33 schtasks.exe 21->33         started        file10 signatures11 process12 file13 48 C:\Users\user\AppData\...\TwqPuOzbnOG.exe, PE32 23->48 dropped 50 C:\Users\user\AppData\Local\...\tmp230B.tmp, XML 23->50 dropped 92 Multi AV Scanner detection for dropped file 23->92 94 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 23->94 96 Machine Learning detection for dropped file 23->96 106 3 other signatures 23->106 35 nick39100.scr 2 23->35         started        38 powershell.exe 4 23->38         started        40 powershell.exe 4 23->40         started        42 schtasks.exe 23->42         started        98 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 27->98 100 Tries to steal Mail credentials (via file / registry access) 27->100 102 Tries to harvest and steal ftp login credentials 27->102 104 Tries to harvest and steal browser information (history, passwords, etc) 27->104 signatures14 process15 signatures16 86 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 35->86 88 Tries to steal Mail credentials (via file / registry access) 35->88 90 Installs new ROOT certificates 38->90
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e/
Threat name:
Document-Office.Exploit.CVE-2017-0199
Create hunting rule
Status:
Malicious
First seen:
2024-07-15 11:59:04 UTC
File Type:
Document
Extracted files:
12
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k2c2ygaogigfbjwe24cwtik5gf7zwa5264ijdocpbek45risq2pa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240715-n5qgmsvgrl/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Abuses OpenXML format to download file from external location
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
AgentTesla
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/32f52473-d2a2-474c-b3ee-cfc48b758862
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5685ac180e32/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Word file doc 5685ac180e320c50a6c4d70569a15d317f9b03baf71091b84f0915cec512869e

(this sample)

AgentTesla

Word file doc 50db4947b7b376e1dcf502a704bd87dbbc7a04959720f5c2b9390d171cef240c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50db4947b7b376e1dcf502a704bd87dbbc7a04959720f5c2b9390d171cef240c
  
Dropping
MD5 cfd4d9dd527b39666c60b568cba3c5a1
  
Dropping
SHA256 05da9848e44274f32cf592fb476550dedcea2477d9ae2cce3dbf8c20c04cf188
  
Dropping
MD5 ff7bf50a80985677e556206bd39e9401

Comments