MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e44fd93a9fd25798e0de27d7ae1c0562d5e1f523306172cc730727021928ff6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e44fd93a9fd25798e0de27d7ae1c0562d5e1f523306172cc730727021928ff6
SHA3-384 hash: ef98c60389fe94c3a3396d96bc7ae22e212317bdbb0d524ca732d8848f1cd272861635815a2d6a24203d52bb79e7ba07
SHA1 hash: e027fed93b879f2997499e2df1a8060c072c6a9f
MD5 hash: 16d608d49f6bde1f95c1763bdbf7661a
humanhash: paris-bakerloo-december-enemy
File name:DHL Original shipping Document_pdf.ppam
Download: download sample
Signature AgentTesla
Create hunting rule
File size:32'108 bytes
First seen:2021-12-02 08:53:25 UTC
Last seen:Never
File type:PowerPoint file ppam
MIME type:application/vnd.openxmlformats-officedocument.presentationml.presentation
ssdeep 768:HPieJ2ry1uHlp6qio8iUWgp4g19rrItJX6eazJZX:H74yOp6q38iUXL19HItJX6eC3
TLSH T1C9E2F122EDCC6BC2EE16463B41CD249FA1D3E554F337CB3160C54CC2399A95EE82AB15
Reporter abuse_ch
Tags:AgentTesla DHL ppam

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.AutoTriggerEvilMrFantasyM3.20200721.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EvilMrFantasyIceIsNiceEdition.20200806.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.WhatItSoundsLikeWhenEncodersCry.20210216.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Legacy PowerPoint File with Macro
Link:
https://app.docguard.net/8e44fd93a9fd25798e0de27d7ae1c0562d5e1f523306172cc730727021928ff6/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
macros macros-on-open
Link:
https://www.filescan.io/uploads/61a889aff9d950eb11b66da0/reports/d9d0009f-ca41-4eb2-806e-1a550ab26a12/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/8e44fd93a9fd25798e0de27d7ae1c0562d5e1f523306172cc730727021928ff6
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/899980
Signature
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Creates processes via WMI
Document contains an embedded VBA with base64 encoded strings
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document exploit detected (process start blacklist hit)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Change PowerShell Policies to a Unsecure Level
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious MSHTA Process Patterns
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Writes or reads registry keys via WMI
Writes registry values via WMI
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532516 Sample: DHL Original shipping Docum... Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 52 Antivirus detection for dropped file 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Machine Learning detection for sample 2->56 58 9 other signatures 2->58 8 cmd.exe 1 2->8         started        10 WmiPrvSE.exe 3 2->10         started        13 taskeng.exe 1 2->13         started        15 8 other processes 2->15 process3 dnsIp4 18 POWERPNT.EXE 9 15 8->18         started        68 Creates autostart registry keys with suspicious values (likely registry only malware) 10->68 70 Creates multiple autostart registry keys 10->70 72 Creates an autostart registry key pointing to binary in C:\Windows 10->72 20 mshta.exe 1 24 13->20         started        48 www.starinxxxgkular.duckdns.org 142.251.40.228, 49179, 49187, 80 GOOGLEUS United States 15->48 50 www.google.com 172.217.168.68, 49182, 49183, 80 GOOGLEUS United States 15->50 signatures5 process6 dnsIp7 24 mshta.exe 4 13 18->24         started        36 blogspot.l.googleusercontent.com 172.217.168.1, 443, 49168, 49172 GOOGLEUS United States 20->36 38 accounts.google.com 172.217.168.45, 443, 49175 GOOGLEUS United States 20->38 40 6 other IPs or domains 20->40 34 C:\Users\user\AppData\Local\...\8[1].htm, HTML 20->34 dropped 28 powershell.exe 20->28         started        file8 process9 dnsIp10 42 j.mp 67.199.248.16, 443, 49165 GOOGLE-PRIVATE-CLOUDUS United States 24->42 44 download2391.mediafire.com 199.91.155.132, 443, 49167 MEDIAFIREUS United States 24->44 46 www.mediafire.com 104.16.203.237, 443, 49166 CLOUDFLARENETUS United States 24->46 60 Bypasses PowerShell execution policy 24->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 24->62 64 Creates processes via WMI 24->64 66 2 other signatures 24->66 30 powershell.exe 6 24->30         started        32 schtasks.exe 24->32         started        signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e44fd93a9fd25798e0de27d7ae1c0562d5e1f523306172cc730727021928ff6/
Threat name:
Script-Macro.Downloader.SLoad
Create hunting rule
Status:
Malicious
First seen:
2021-12-02 05:25:08 UTC
File Type:
Document
Extracted files:
15
AV detection:
19 of 44 (43.18%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzcp3e5j7usxtdqn4j6xvyoakywv4h2sgmdbolghgbzhaimsr73a._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211202-ktwmqsdehm/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
AgentTesla Payload
AgentTesla
Process spawned unexpected child process
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8e44fd93a9fd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e44fd93a9fd25798e0de27d7ae1c0562d5e1f523306172cc730727021928ff6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments