MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59a21410a7c7902a8f1f1b7114699d2ebbf63f2793ff30caae74fd214fc3e91f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59a21410a7c7902a8f1f1b7114699d2ebbf63f2793ff30caae74fd214fc3e91f
SHA3-384 hash: 7e7acfefe9a99b255eb2b77c42ad5af8f7a608a161ddc93f50ae219fa64f1680fdb62069491bb13880c997333cc7bbaf
SHA1 hash: a6a5a6edf380697fcabad21ee30f4c7279f164ec
MD5 hash: 3ea92181f542d6c5932081e7aa21282a
humanhash: charlie-don-seventeen-london
File name:HVD.vbs
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'716 bytes
First seen:2023-09-20 13:21:10 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:ALEHEHEHEHEHEQoZRi2EHEHEHEHEHEmEHEHEHEHEHEsEHEHEHEHEHEvOKEHEHEHt:kZRhOzIASO
Threatray 5'478 similar samples on MalwareBazaar
TLSH T1E8548A2035EB544CB1737F532BEDF6FA8FAFBBA1570A916D2500030B9652E84CDA9631
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter James_inthe_box
Tags:AgentTesla vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/450037/
Detection(s):
SecuriteInfo.com.HEUR.Trojan.Script.Generic.14708.5823.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/650af1fe83a0c6425dfa678f/reports/713aa752-cfa0-4d31-a77d-17f6d91dc168/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/59a21410a7c7902a8f1f1b7114699d2ebbf63f2793ff30caae74fd214fc3e91f
Result
Verdict:
MALICIOUS
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1311567
Signature
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell download and load assembly
Sigma detected: RegAsm connects to smtp port
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AgentTesla
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1311567 Sample: HVD.vbs Startdate: 20/09/2023 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus detection for URL or domain 2->38 40 5 other signatures 2->40 8 wscript.exe 1 2->8         started        process3 signatures4 50 VBScript performs obfuscated calls to suspicious functions 8->50 52 Suspicious powershell command line found 8->52 54 Wscript starts Powershell (via cmd or directly) 8->54 56 3 other signatures 8->56 11 powershell.exe 7 8->11         started        process5 signatures6 58 Suspicious powershell command line found 11->58 60 Found suspicious powershell code related to unpacking or dynamic code loading 11->60 14 powershell.exe 14 15 11->14         started        18 conhost.exe 11->18         started        process7 dnsIp8 30 uploaddeimagens.com.br 104.21.45.138, 443, 49709 CLOUDFLARENETUS United States 14->30 32 94.156.161.167, 49710, 80 NET1-ASBG Bulgaria 14->32 62 Writes to foreign memory regions 14->62 64 Injects a PE file into a foreign processes 14->64 20 RegAsm.exe 15 7 14->20         started        signatures9 process10 dnsIp11 24 awelleh3.top 185.198.59.26, 49712, 49715, 587 HSAE Netherlands 20->24 26 mail.awelleh3.top 20->26 28 3 other IPs or domains 20->28 42 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->42 44 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->44 46 May check the online IP address of the machine 20->46 48 2 other signatures 20->48 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59a21410a7c7902a8f1f1b7114699d2ebbf63f2793ff30caae74fd214fc3e91f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lgrbiefhy6icvdy7dnyri2m5f257mpzhsp7tbsvoot6sct6d5epq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
26176205211fdce7ad34cf10d72f178f1646e913e368f0f5bcc325e5428a69cc
AgentTesla
6d0ab1c3aadadef9335264a57ef26a307636d0367f57695f95284f03fa5e4111
AgentTesla
6d5b825b8559f912c5e26bb5290bffb54c674347f98711fc9e63d2aed0bc9c12
AgentTesla
79c75f759d9a8443bdf2bbde5741af34b30e4c94bfa15ccf42dcb58f851e9a47
AgentTesla
93d5fb740afe932aec452032bc39786d85ae3254d79a8e388728189a53174226
AgentTesla
aafd707672f8c520542b9a1ef2c675f057fe3d2a96262e363c11c8c542a68a2c
AgentTesla
be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf
AgentTesla
d7093e702ca2995bfe864781a9476419a95efcd51d29805ce721021da24e4e94
AgentTesla
fbd8e3fb6bcaf0e1509d30735a9c268659bf53a32f8ce933148763672e7387c5
AgentTesla
+ 5'468 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230920-ql8j8age3z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://uploaddeimagens.com.br/images/004/613/515/original/rump_vbs_antivm.jpg?1695147255
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/59a21410a7c7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/59a21410a7c7902a8f1f1b7114699d2ebbf63f2793ff30caae74fd214fc3e91f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_VBS_Wscript_Shell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/450037/
  
URLhaus
https://urlhaus.abuse.ch/url/2712703/

Comments