MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf
SHA3-384 hash: 79091be3d65c356431d6786b4530c994264af9404e9208eb484813c2ffe9b106d70074b468113be2f92ac9079e61f071
SHA1 hash: c626fe49cee559f9e051e36817c9b8423a796f22
MD5 hash: b5ada8744016020003b96b679475b933
humanhash: autumn-montana-nineteen-wisconsin
File name:HVS.vbs
Download: download sample
Signature AgentTesla
Create hunting rule
File size:178'622 bytes
First seen:2023-08-17 13:03:41 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 1536:QywMR8Yg536jHZztjnZU7t3ADd9tieHjfqGxWpKFY1FenJxci/R99404a4y4+4lO:JjWudjjRFY1FGxci/Rqy
Threatray 4'375 similar samples on MalwareBazaar
TLSH T11D049A1161EE648DB2737E530BDEA9F98F17F7E1173A60AE2048130B8B9AD44CE55372
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter James_inthe_box
Tags:AgentTesla vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/443205/
Detection(s):
SecuriteInfo.com.VBS.Obfuscated-JF.29230.26837.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1292762
Signature
Antivirus detection for URL or domain
Drops VBS files to the startup folder
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Sigma detected: Drops script at startup location
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1292762 Sample: HVS.vbs Startdate: 17/08/2023 Architecture: WINDOWS Score: 100 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 Sigma detected: Drops script at startup location 2->62 8 wscript.exe 1 2->8         started        11 wscript.exe 1 2->11         started        process3 signatures4 66 VBScript performs obfuscated calls to suspicious functions 8->66 68 Suspicious powershell command line found 8->68 70 Wscript starts Powershell (via cmd or directly) 8->70 13 cmd.exe 1 8->13         started        16 powershell.exe 5 8->16         started        72 Very long command line found 11->72 18 cmd.exe 1 11->18         started        20 powershell.exe 11->20         started        process5 signatures6 80 Wscript starts Powershell (via cmd or directly) 13->80 82 Uses ping.exe to sleep 13->82 84 Uses ping.exe to check the status of other devices and networks 13->84 22 cmd.exe 1 13->22         started        25 PING.EXE 1 13->25         started        28 conhost.exe 13->28         started        86 Suspicious powershell command line found 16->86 30 powershell.exe 14 16 16->30         started        32 conhost.exe 16->32         started        34 cmd.exe 1 18->34         started        40 2 other processes 18->40 36 powershell.exe 20->36         started        38 conhost.exe 20->38         started        process7 dnsIp8 64 Wscript starts Powershell (via cmd or directly) 22->64 42 powershell.exe 9 22->42         started        50 127.0.0.1 unknown unknown 25->50 52 uploaddeimagens.com.br 188.114.96.7, 443, 49764, 49765 CLOUDFLARENETUS European Union 30->52 54 94.156.161.167, 49768, 49769, 80 NET1-ASBG Bulgaria 30->54 46 powershell.exe 9 34->46         started        56 192.168.2.1 unknown unknown 40->56 signatures9 process10 file11 48 C:\Users\user\AppData\Roaming\...\Im.vbs, Unicode 42->48 dropped 74 Suspicious powershell command line found 42->74 76 Drops VBS files to the startup folder 42->76 78 Found suspicious powershell code related to unpacking or dynamic code loading 42->78 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf/
Threat name:
Script-WScript.Trojan.Minerva
Create hunting rule
Status:
Malicious
First seen:
2023-08-17 13:03:38 UTC
File Type:
Text (VBS)
AV detection:
8 of 23 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xyktuqbwx732c37lwcbb7j47ann7v3itpqgcvgm7zuz6asczu7hq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
32fcd31207c5e310957801fca81578c9dcba9ed3515809f62a7d50d93ad033db
AgentTesla
3f92752540e0658dc96fef662e8f96f9552383c8b8da50ea7707b35727a645de
AgentTesla
60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623
AgentTesla
6234c83cf8e46f8e09fed9cbf0456be735dc8640c2df0ee4734b7fa730e0b8eb
AgentTesla
a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509
AgentTesla
b9a72ccaad2c22150062d59d79744e1ab3aa5a106aa0837bdde9e05ccb39c91e
AgentTesla
ba426d437309667874833f60de7397597e17a6daa59fac280cbe6bed820195dc
AgentTesla
cdb463c9aeff4b1d0090647e3baa27f32360301b0be912489f2b32e1f469650e
AgentTesla
defebb0452d939312ce8e3fd24d5b88a4614b4bad1b10251aaac75115b2f69a3
AgentTesla
e75e7b4f4db640c54deb092dd373afa2b692a2078461cd0193e2b54b84c8250c
AgentTesla
+ 4'365 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230817-qaxzcabb4w/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops startup file
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/be153a4036bf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/443205/
  
URLhaus
https://urlhaus.abuse.ch/url/2705176/

Comments