MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fe28392ed74cab65862f53a220dc2139b4d58ec342da62487c5a6e62999fe67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8fe28392ed74cab65862f53a220dc2139b4d58ec342da62487c5a6e62999fe67
SHA3-384 hash:	68202473548e7548fe52fe78d18b31e6d206c833ce54d11557e2c60c852a0286deb1cfe0c0d0abf5134d630e9d6ae7c0
SHA1 hash:	61483c19add8ef204b30813b9a7057d8e2130851
MD5 hash:	566129719731e07bb58e6fddda42ad7c
humanhash:	network-asparagus-wolfram-comet
File name:	LUG.vbs
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	379'750 bytes
First seen:	2023-09-27 13:10:34 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	3072:Wn6n16KJRPrKPZGkI3P94899999V99999U99999m99999p99999C99999c99999Y:W6n1RAIkIFq
Threatray	5'681 similar samples on MalwareBazaar
TLSH	T1A2847E1035EF644CB1B37F536BECB6E58A9FFBF2671AA05A2504430B4A62E44CD61732
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	James_inthe_box
Tags:	AgentTesla vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

123

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/451587/

ClamAV Detected

Detection(s):

SecuriteInfo.com.HEUR.Trojan-Downloader.Script.Generic.2777.4890.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/651429e8f1b40cb0d6233a1a/reports/c3c12ff9-cda2-4d21-9021-1313ff35fad7/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8fe28392ed74cab65862f53a220dc2139b4d58ec342da62487c5a6e62999fe67

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1315273

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Contains functionality to register a low level keyboard hook

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Installs a global keyboard hook

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell download and load assembly

Sigma detected: RegAsm connects to smtp port

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8fe28392ed74cab65862f53a220dc2139b4d58ec342da62487c5a6e62999fe67/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-27 06:25:12 UTC

File Type:

Text (VBS)

AV detection:

6 of 23 (26.09%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r7rihexnotflmwdc6u5cedocconu2whmgqw2mjehywtomkmz7ztq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

2532cb332efc6086c05d5de55eb02cbedbb053f10400076a521540542248986b

AgentTesla

5fd07dc149245f0e030ebc164f54ab264c41afee13f1015c59bf3bc10fdbc37d

AgentTesla

8eb67ef01c5b94ac2d62942cc2b7678b1172350028dab7d9f5e04010ac4b9d78

AgentTesla

9bf12c191a2f0fb6fdd1a9e0f382d2bcc976671ad79202163b516474cb3989df

AgentTesla

a9c86947b445df66fe7859c36885e11455743c776a4e9911192e9a355eecde04

AgentTesla

cc0ff94435a883b461d26716d636619c6c670e6e574a2f58ad76f5c1f6de5d40

AgentTesla

d01903480e2d2cc9a33d4318568d77ee3e04531e74b91f09cfff9d1d99d38b6e

AgentTesla

d33f5262375dff205d38b290de80d6b6a7b5edeb5a0d5f1b01048bd3a371cd42

AgentTesla

+ 5'671 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230927-qeyfnscb68/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Malware Config

Dropper Extraction:

https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937

VMRay AgentTesla.v4

Malware family:

AgentTesla.v4

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8fe28392ed74/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI AgentTesla

Threat name:

AgentTesla

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/8fe28392ed74cab65862f53a220dc2139b4d58ec342da62487c5a6e62999fe67

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Delivery method

Other

Cape

https://www.capesandbox.com/analysis/451587/