MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd1cfccc52b5ead10729558fda4e8827cd116c1d98529fd821709d6890f88b93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bd1cfccc52b5ead10729558fda4e8827cd116c1d98529fd821709d6890f88b93
SHA3-384 hash:	205e06c8c01b8420377c40fe06f6dfc375fb8136841bc76438f5712c362bdb649541ea0ee674d1272dde8e8921e7a7db
SHA1 hash:	d9126422c986b254ef06296768a9f6f65743093c
MD5 hash:	bf3bb6d76d480941f01f473e07bc61fa
humanhash:	fourteen-south-cardinal-steak
File name:	S_D_93020304994440.vbs
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	300'634 bytes
First seen:	2023-08-22 07:44:05 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	6144:6zi6wrr2crrSreAQWhLpdwauSLDm0qaQrrrrd2BkLSWBsNw/2w2r2hoT/REHT3HH:6O/2w2r2hoTu
Threatray	5'616 similar samples on MalwareBazaar
TLSH	T19754BF1020EE648DB1B37F921BED7CE94F6BB7A51A3A645D204C434B8B53E84CE55B32
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	abuse_ch
Tags:	AgentTesla vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

110

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/444074/

FileScan.io

Gathering data

Hybrid Analysis Trojan.Script.Hworm

Verdict:

Malicious

Labled as:

Trojan.Script.Hworm

Link:

https://www.hybrid-analysis.com/sample/bd1cfccc52b5ead10729558fda4e8827cd116c1d98529fd821709d6890f88b93

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1294941

Signature

Antivirus detection for URL or domain

Drops VBS files to the startup folder

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Drops script at startup location

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses the Telegram API (likely for C&C communication)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd1cfccc52b5ead10729558fda4e8827cd116c1d98529fd821709d6890f88b93/

ReversingLabs TitaniumCloud Script-WScript.Malware.Heuristic

Threat name:

Script-WScript.Malware.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-08-22 07:36:04 UTC

File Type:

Text (VBS)

AV detection:

1 of 37 (2.70%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xuopztcswxvncbzjkwh5utuie7grc3a5tbjj7wbbocowrehyrojq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

044cb562792bad9d4aa1fa99fcb642ed6bf4dd49af86938b75add85d021fa101

AgentTesla

1e5d0ecba17e0de6cf37f9a37e31c9c9a5883df357b0499592598d3921804b3a

AgentTesla

2ad4c4f27ff93553beebc1e426bd73cb6415c88bb233442fdc727de557a95c2d

AgentTesla

4dd2b1081222991f76595cae95f0e3b47f56b2cef85177fee637a2534196dfc7

AgentTesla

ac9e25f541065a26fb3dcb26ac76ca5c5ffd44a03973a07f049730f0760d4b04

AgentTesla

c98f9d2a27cf5718577e4b9a2ed0f8bb606b1a5a79bf0f69b454ccd3d8522c15

AgentTesla

d2f74dbb944eb5699de861b7044b5aa9c9f3904d166bdab705a4024b0bc34eaf

AgentTesla

e1b7acfbe15a0fde89a1bb1f0f51142061b2ff50bc6c33c770a40f1c43b0d7f6

AgentTesla

e7a157ba1819d7af9a5f66aa9e161cce68d20792d117a90332ff797cbbd8aaa5

AgentTesla

f03f1ae3d3d6bde555d9bc841f8b11ee27459cb9937ae50298b24acb3190552e

AgentTesla

+ 5'606 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/230822-jld72sag38/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Looks up external IP address via web service

Drops startup file

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Blocklisted process makes network request

Malware Config

Dropper Extraction:

https://uploaddeimagens.com.br/images/004/559/510/original/rump_private.jpg?1690504129

VMRay AgentTesla.v4

Malware family:

AgentTesla.v4

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bd1cfccc52b5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/bd1cfccc52b5ead10729558fda4e8827cd116c1d98529fd821709d6890f88b93

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

vbs bd1cfccc52b5ead10729558fda4e8827cd116c1d98529fd821709d6890f88b93

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/444074/