MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbedfa89304be7b11dd7a4f9c77fae18bb0896ed6680dd22fcd9c786e54153bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbedfa89304be7b11dd7a4f9c77fae18bb0896ed6680dd22fcd9c786e54153bb
SHA3-384 hash: 2fb315d2c941d673322e94cff4668f8c6611c23e73f968309ffe5c4dd3a4726a9bef1fbd97656c39847c63e000c7f257
SHA1 hash: 6e249f558a44d3864f23a8aa4bdcbbf9cce741eb
MD5 hash: 60cf4455b14792257701d1e840a7b9fd
humanhash: leopard-network-speaker-cola
File name:PO 20240510.xla
Download: download sample
Signature AgentTesla
Create hunting rule
File size:163'840 bytes
First seen:2024-05-10 10:18:19 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/vnd.ms-excel
ssdeep 3072:y8tq3KR9pLmLXqr/LHTmfeakX2qCvrkiM0myrFyPxlnywonug09s7P:y6NCLXqzLzKeNmLwfFWwnuF09q
TLSH T1BEF302B13372D803D0224278CDD4D6EF62167C529E9BD65F38D07B2D2A398C69B63B91
TrID 46.5% (.XLS) Microsoft Excel sheet (alternate) (56500/1/4)
26.7% (.XLS) Microsoft Excel sheet (32500/1/3)
20.1% (.XLS) Microsoft Excel sheet (alternate) (24500/1/2)
6.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter NDA0E
Tags:AgentTesla xlsx

Intelligence

File Origin
# of uploads :
1
# of downloads :
473
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cbedfa89304be7b11dd7a4f9c77fae18bb0896ed6680dd22fcd9c786e54153bb.xlsx
Verdict:
Suspicious activity
Analysis date:
2024-05-10 10:19:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9d18d756-0868-485c-9537-ac62599526d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
TwinWave.EvilDoc.93TilInfinity.20240412.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Creating a window
DNS request
Sending an HTTP GET request
Searching for synchronization primitives
Launching a process
Сreating synchronization primitives
Connection attempt by exploiting the app vulnerability
Sending a custom TCP request by exploiting the app vulnerability
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/cbedfa89304be7b11dd7a4f9c77fae18bb0896ed6680dd22fcd9c786e54153bb/results/dashboard
Payload URLs
URL
File name
http://dokdo.in/xtY
Embedded Ole
Behaviour
SuspiciousRTF detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
88%
Tags:
macros masquerade
Link:
https://www.filescan.io/uploads/663df4a811114a9ab5e7facf/reports/9d1f1c6b-3d9b-4395-91aa-966e53b2956f/overview
Verdict:
Malicious
Labled as:
CVE-2017-0199
Link:
https://www.hybrid-analysis.com/sample/cbedfa89304be7b11dd7a4f9c77fae18bb0896ed6680dd22fcd9c786e54153bb
Gathering data
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1439527
Signature
Antivirus detection for dropped file
Connects to a pastebin service (likely for C&C)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Malicious sample detected (through community Yara rule)
Microsoft Office drops suspicious files
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Shellcode detected
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: Equation Editor Network Connection
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
System process connects to network (likely due to code injection or exploit)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1439527 Sample: PO 20240510.xla.xlsx Startdate: 10/05/2024 Architecture: WINDOWS Score: 100 36 dokdo.in 2->36 52 Multi AV Scanner detection for domain / URL 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus detection for dropped file 2->56 58 11 other signatures 2->58 8 EXCEL.EXE 52 46 2->8         started        signatures3 process4 dnsIp5 40 dokdo.in 172.67.148.22, 443, 49163, 49164 CLOUDFLARENETUS United States 8->40 42 mmaemojo.hopto.org 192.3.243.154, 49165, 49175, 49176 AS-COLOCROSSINGUS United States 8->42 26 beautifulrpearound...ifulthingsto[1].doc, ISO-8859 8->26 dropped 12 WINWORD.EXE 337 37 8->12         started        17 wscript.exe 9 8->17         started        file6 process7 dnsIp8 44 mmaemojo.hopto.org 12->44 46 dokdo.in 12->46 28 C:\Users\user\AppData\Roaming\...\xtY.url, MS 12->28 dropped 30 C:\Users\user\AppData\...\dokdo.in.url, MS 12->30 dropped 32 ~WRF{81264CDC-E66E...A-F2BE979D488F}.tmp, Composite 12->32 dropped 34 C:\Users\user\AppData\Local\...\29C9D60F.doc, ISO-8859 12->34 dropped 64 Microsoft Office launches external ms-search protocol handler (WebDAV) 12->64 66 Office viewer loads remote template 12->66 68 Microsoft Office drops suspicious files 12->68 19 EQNEDT32.EXE 12 12->19         started        48 paste.ee 17->48 50 paste.ee 104.21.84.67, 443, 49177 CLOUDFLARENETUS United States 17->50 70 System process connects to network (likely due to code injection or exploit) 17->70 72 Windows Scripting host queries suspicious COM object (likely to drop second stage) 17->72 file9 74 Connects to a pastebin service (likely for C&C) 48->74 signatures10 process11 dnsIp12 38 mmaemojo.hopto.org 19->38 24 C:\Users\...\verycuteflowerpictureimag.vbs, Unicode 19->24 dropped 60 Office equation editor establishes network connection 19->60 62 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 19->62 file13 signatures14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbedfa89304be7b11dd7a4f9c77fae18bb0896ed6680dd22fcd9c786e54153bb/
Threat name:
Document-Excel.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2024-05-10 09:23:06 UTC
File Type:
Document
Extracted files:
41
AV detection:
6 of 38 (15.79%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zpw7vcjqjpt3choxut44o75odc5qrfxnm2an2ix43hdynzkbko5q._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/240510-mchewscc92/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Launches Equation Editor
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Office loads VBA resources, possible macro or embedded object present
Drops file in System32 directory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Abuses OpenXML format to download file from external location
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
AgentTesla
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cbedfa89304b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cbedfa89304be7b11dd7a4f9c77fae18bb0896ed6680dd22fcd9c786e54153bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:office_document_vba
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Office document with embedded VBA
Reference:https://github.com/jipegit/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Excel file xlsx cbedfa89304be7b11dd7a4f9c77fae18bb0896ed6680dd22fcd9c786e54153bb

(this sample)

AgentTesla

Word file doc 305ec5d66a74953ee3770392717facc773d4c84a718bd92f05f25890f49daf66

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 305ec5d66a74953ee3770392717facc773d4c84a718bd92f05f25890f49daf66
  
Dropping
MD5 ddf0d6abbedc2008fd46d6c9d5f17bef

Comments