MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 867fae444c5935d14659dd105155a8cc0b0b2a4e0faf1dc5e684fe72dd0bd4ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	867fae444c5935d14659dd105155a8cc0b0b2a4e0faf1dc5e684fe72dd0bd4ea
SHA3-384 hash:	ec6f212ad48c2b1194ced33d2dbbd8a7e429d42ea1c82faf9bfc894a34494918f9f7dcd41943b9dd532c523c79f231c6
SHA1 hash:	7d1f8c9510c3d943a9a6201573b9a54260361159
MD5 hash:	f9c2d3dd073b494af2799ebdedc6a995
humanhash:	twelve-potato-burger-apart
File name:	228750794 AWB 6698324651_20122023006571.vbe
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	47'023 bytes
First seen:	2023-12-22 07:10:33 UTC
Last seen:	Never
File type:	vbe
MIME type:	text/plain
ssdeep	768:Dfh/Drg00RVLSntGoTPUKdy2f8cBKD8/kkBGXBw7I70W2RDRumdSXGe:Dp/DrAStB/THKD8/kIfW27up
Threatray	434 similar samples on MalwareBazaar
TLSH	T10823F5E1CA85371949CE274ADF404874C1688CDE4F165E19ADB507BE20C7788B77FA2B
Reporter	abuse_ch
Tags:	AgentTesla vbe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

74

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.DownLoader.2988.24272.21147.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm

Link:

https://www.filescan.io/uploads/6585368beabaed070172408f/reports/39ba340e-31ee-417d-8d28-953c3ccc1d59/overview

Hybrid Analysis Valyria

Verdict:

Malicious

Labled as:

Valyria

Link:

https://www.hybrid-analysis.com/sample/867fae444c5935d14659dd105155a8cc0b0b2a4e0faf1dc5e684fe72dd0bd4ea

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla, GuLoader

Result

Threat name:

AgentTesla, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1366014

Signature

Antivirus detection for URL or domain

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Powershell uses Background Intelligent Transfer Service (BITS)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected GuLoader

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

ASCII

Link:

https://malprob.io/report/867fae444c5935d14659dd105155a8cc0b0b2a4e0faf1dc5e684fe72dd0bd4ea

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/867fae444c5935d14659dd105155a8cc0b0b2a4e0faf1dc5e684fe72dd0bd4ea/

ReversingLabs TitaniumCloud Script-WScript.Trojan.GuLoader

Threat name:

Script-WScript.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-20 13:18:52 UTC

File Type:

Text (VBS)

AV detection:

12 of 37 (32.43%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qz724rcmle25crsz3uifcvnizqfqwksob6xr3rpgqt7hfxil2tva._file

Threatray agenttesla_v4 agenttesla cloudeye

Verdict:

malicious

Label(s):

agenttesla_v4

Alert

Create hunting rule

agenttesla

Alert

Create hunting rule

cloudeye

Alert

Create hunting rule

Similar samples:

059c83df4a5e6c7a5de9e681465436478fde86d63c81d7d3849f588d5c80f397

AgentTesla

0972105c3cb2d74e7cb3f00ddcc6cc96089524d5625b62f71e27d5857c6eba40

AgentTesla

1e2ee43e269f7144725650607d8055ecc9dce77dde8fd13fc25fb4c85c0055b0

AgentTesla

3b9f9fc739dfb6d59c22f7b0ee4134f404ae4faaea7b01896363a657f6db3643

AgentTesla

436f74f3d2537685ed53a9a83ae70cc1a98e987d90ba949ca879a854e2970ed9

AgentTesla

867fae444c5935d14659dd105155a8cc0b0b2a4e0faf1dc5e684fe72dd0bd4ea

AgentTesla

91f39eaf24b90582ffb859ec2f586c195ce13c252941ccf1e63314f05b80200f

AgentTesla

+ 424 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231222-hzx2msdec4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot5607670089:AAHDyW2zijSScYJ2RdPWDO-CgeTo7-m6ur8/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/867fae444c5935d14659dd105155a8cc0b0b2a4e0faf1dc5e684fe72dd0bd4ea