MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9c341a4d3683381ba0a0be94b8862a37af26755144655848272c6462c1c305b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a9c341a4d3683381ba0a0be94b8862a37af26755144655848272c6462c1c305b
SHA3-384 hash:	e20e91c28ad30b46c4628b17316eb4f9768341a46e23f18b8b646e281e4ac9c7bcdc275236d51557a8f71b532db7fae3
SHA1 hash:	858222971fc89157f54d1b200973f02870afad0d
MD5 hash:	0377257157ea1f40c2262d3abc33fd6a
humanhash:	massachusetts-friend-echo-comet
File name:	orden9808-898.vbs
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	167'924 bytes
First seen:	2023-11-10 06:25:44 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:5gm4STQ8E11111P11111011111D11111M11111f11111+11111K11111v11111xw:5gm4STQ8o04dSKSOG
TLSH	T173F3281077EA5008B1B3AF561EF6B5A94E6FBBB1553A905D204C0A0F4FB3D44CEA1B72
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	abuse_ch
Tags:	AgentTesla vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

105

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.1870.28172.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

cscript lolbin remote wscript

Link:

https://www.filescan.io/uploads/654dcd032546bd423f157a45/reports/2e7605be-d01f-4b5a-85ae-16df992a1fd0/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/a9c341a4d3683381ba0a0be94b8862a37af26755144655848272c6462c1c305b

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1340288

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Obfuscated command line found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

84%

Verdict:

Malware

File Type:

ASCII

Link:

https://malprob.io/report/a9c341a4d3683381ba0a0be94b8862a37af26755144655848272c6462c1c305b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a9c341a4d3683381ba0a0be94b8862a37af26755144655848272c6462c1c305b/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-11-10 06:26:08 UTC

File Type:

Text (VBS)

AV detection:

1 of 38 (2.63%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vhbudjgtnazydoqkbpuuxcdcun5pez2vcrdflbecoldemla4gbnq._file

Threatray malicious

Verdict:

malicious

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231110-g68laacg4z/

Behaviour

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Blocklisted process makes network request

AgentTesla

Malware Config

Dropper Extraction:

https://uploaddeimagens.com.br/images/004/654/536/original/new_image.jpg?1698957750

VMRay AgentTesla.v4

Malware family:

AgentTesla.v4

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a9c341a4d368/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI AgentTesla

Threat name:

AgentTesla

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/a9c341a4d3683381ba0a0be94b8862a37af26755144655848272c6462c1c305b