MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f
SHA3-384 hash: 8718d541d1f5b330de2d693c7965ccef03e0c25cb833376fea18c38c4c7c5304d7376714ff1faeab5b816f2215c95d49
SHA1 hash: 3ddd2f54b7fb54df60134318515fd61b119bc46f
MD5 hash: 3c00879a0e4e4a7d7b78bb8611bcc94f
humanhash: michigan-single-wisconsin-happy
File name:PONO6188.vbs
Download: download sample
Signature AgentTesla
Create hunting rule
File size:60'611 bytes
First seen:2024-04-26 09:07:52 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 1536:cdukLI1gPDPTxyk0MfFCNqnlAEfen8TCQr:Yukk1gPDJzoGaEWn8Tv
TLSH T13743A2AFCF0726081F8E1FD5A869CD5186B701B1F1002439B5ADE7E9A583EAC81F8D5D
Reporter NDA0E
Tags:AgentTesla GuLoader vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
NL NL
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade ping
Link:
https://www.filescan.io/uploads/662b6efdc5dabc22b208b5b7/reports/0e27497d-2815-483d-af7b-e67989c4586a/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f
Result
Verdict:
MALICIOUS
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1432052
Signature
Antivirus detection for URL or domain
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AgentTesla
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1432052 Sample: PONO6188.vbs Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 41 ftp.concaribe.com 2->41 43 nitio.com 2->43 45 3 other IPs or domains 2->45 55 Multi AV Scanner detection for domain / URL 2->55 57 Found malware configuration 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 6 other signatures 2->61 9 wscript.exe 1 2->9         started        signatures3 process4 signatures5 77 VBScript performs obfuscated calls to suspicious functions 9->77 79 Suspicious powershell command line found 9->79 81 Wscript starts Powershell (via cmd or directly) 9->81 83 5 other signatures 9->83 12 powershell.exe 14 19 9->12         started        16 PING.EXE 1 9->16         started        18 cmd.exe 1 9->18         started        20 PING.EXE 1 9->20         started        process6 dnsIp7 51 nitio.com 192.185.13.24, 49722, 49727, 80 UNIFIEDLAYER-AS-1US United States 12->51 85 Suspicious powershell command line found 12->85 87 Very long command line found 12->87 89 Found suspicious powershell code related to unpacking or dynamic code loading 12->89 22 powershell.exe 17 12->22         started        25 conhost.exe 12->25         started        27 cmd.exe 1 12->27         started        53 google.com 172.217.165.206 GOOGLEUS United States 16->53 29 conhost.exe 16->29         started        31 conhost.exe 18->31         started        33 conhost.exe 20->33         started        signatures8 process9 signatures10 71 Writes to foreign memory regions 22->71 73 Found suspicious powershell code related to unpacking or dynamic code loading 22->73 75 Hides threads from debuggers 22->75 35 wab.exe 15 8 22->35         started        39 cmd.exe 1 22->39         started        process11 dnsIp12 47 concaribe.com 192.185.13.234, 21, 49729 UNIFIEDLAYER-AS-1US United States 35->47 49 api.ipify.org 104.26.13.205, 443, 49728 CLOUDFLARENETUS United States 35->49 63 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 35->63 65 Tries to steal Mail credentials (via file / registry access) 35->65 67 Tries to harvest and steal ftp login credentials 35->67 69 2 other signatures 35->69 signatures13
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f/
Threat name:
Script-WScript.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-04-23 14:20:57 UTC
File Type:
Text (VBS)
AV detection:
11 of 23 (47.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=st74ppwaz3ygkugxhg6faffdemwjegffausn4bdewu5w3o6x5vpq._file
Verdict:
malicious
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240426-k3wzvsdc44/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Blocklisted process makes network request
AgentTesla
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/94ffc7bec0ce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments