MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 584bd954035020f5bf4699ff5c1e345b915df35c618aaa85d70d8fd2666a5809. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 584bd954035020f5bf4699ff5c1e345b915df35c618aaa85d70d8fd2666a5809
SHA3-384 hash: e5b0a7a5a66b814f5d6c80ad3fe86bf8cbd92904b1be6d2e10fbb8f525e68cbdccae3b7c38d9264a8d655a3a222575f9
SHA1 hash: ffdb5a203dddc5fc4fcdf1295b14612ef12cd4c5
MD5 hash: 9912d75d6f279a667330d187aeecb51e
humanhash: blue-potato-oregon-ten
File name:documentos DHL.vbs
Download: download sample
Signature AgentTesla
Create hunting rule
File size:197'020 bytes
First seen:2022-10-28 22:03:53 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:5O1dsIKy3d5dwx385lSaPEfriF+uWD21rG2:5Bg9WbES2
Threatray 19'490 similar samples on MalwareBazaar
TLSH T1B9144DA97AFA7999F1F796431E3BF8884B3F38D425209E0D46DC194C1AFE61040A57E3
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter 0xToxin
Tags:AgentTesla vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
429
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/325673/
Detection(s):
SecuriteInfo.com.VBS.Obfus-190.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/635c51d9ce1f43143c29e7f0/reports/21e149f3-3dd4-4b1c-a272-728a62a042d3/overview
Result
Verdict:
SUSPICIOUS
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1100664
Signature
Antivirus detection for URL or domain
Downloads files with wrong headers with respect to MIME Content-Type
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
VBScript performs obfuscated calls to suspicious functions
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AgentTesla
Yara detected Generic Downloader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 733325 Sample: documentos DHL.vbs Startdate: 29/10/2022 Architecture: WINDOWS Score: 100 34 Snort IDS alert for network traffic 2->34 36 Multi AV Scanner detection for domain / URL 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 6 other signatures 2->40 8 wscript.exe 1 2->8         started        11 powershell.exe 15 2->11         started        process3 signatures4 50 VBScript performs obfuscated calls to suspicious functions 8->50 52 Suspicious powershell command line found 8->52 54 Wscript starts Powershell (via cmd or directly) 8->54 13 powershell.exe 14 17 8->13         started        17 powershell.exe 12 11->17         started        19 conhost.exe 1 11->19         started        process5 dnsIp6 30 20.7.14.99, 49698, 80 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 13->30 32 195.178.120.24, 49699, 80 HEXAGLOBE-ASFR unknown 13->32 56 Suspicious powershell command line found 13->56 58 Writes to foreign memory regions 13->58 60 Injects a PE file into a foreign processes 13->60 21 RegAsm.exe 2 13->21         started        24 powershell.exe 12 13->24         started        26 conhost.exe 13->26         started        signatures7 process8 signatures9 42 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 21->42 44 Tries to steal Mail credentials (via file / registry access) 21->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 21->46 48 Tries to harvest and steal browser information (history, passwords, etc) 21->48 28 conhost.exe 24->28         started        process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/584bd954035020f5bf4699ff5c1e345b915df35c618aaa85d70d8fd2666a5809/
Threat name:
Script.Trojan.Minerva
Create hunting rule
Status:
Malicious
First seen:
2022-10-28 20:21:13 UTC
File Type:
Text
AV detection:
8 of 26 (30.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lbf5svadkaqplp2gth7vyhruloiv3424mgfkvboxbwh5eztklaeq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1630b75d1b5ddf643b087a45f57a6282181c522b7fc68adea3f8f1e240602d06
AgentTesla
45340696f311075cbef1929f4ce534aaa3b872e75f15a9d538ba7cd4f45b717d
AgentTesla
45fa164b6426a399c2720ae533c6ad0f5d024cf6d7a2f43313ab1b8d5ac9c269
AgentTesla
53f30e0174d4f4a422bc8ee8ab174bf13c96dc312b6c472ccf43b6e33262f976
AgentTesla
6c177f41f62f5cc7d9f8f3ce384c1ed1aabf9ff0e181e5f7a1f59d450b731a8f
AgentTesla
a0b715dbe6410280098b511f7cf95b466c14f15de32ed2cd79744d2ebd7ad8ff
AgentTesla
a46ba907fa55dea9842e0c9a005d71190c7630d033432fa60c5e2996333c3bd9
AgentTesla
a63df56777dee301cd34280144b498d17c8e7c0ccf057224abf73cab1b220b68
AgentTesla
eb315f25a82f07dac9c40b3eac6db816a46ed3755f79d01a64c1681e148bee82
AgentTesla
+ 19'480 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/221028-1yxnlahfck/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Drops startup file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Blocklisted process makes network request
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5387517837:AAHI8L3I-OHmq0oJo6tuPuoRyKMJax0PL9I/
Dropper Extraction:
http://20.7.14.99/dll/dll_ink.pdf
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/584bd9540350/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/584bd954035020f5bf4699ff5c1e345b915df35c618aaa85d70d8fd2666a5809

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_VBS_Wscript_Shell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon
Rule name:Windows_Trojan_AgentTesla_d3ac2b2f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Visual Basic Script (vbs) vbs 584bd954035020f5bf4699ff5c1e345b915df35c618aaa85d70d8fd2666a5809

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/325673/

Comments