MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdb463c9aeff4b1d0090647e3baa27f32360301b0be912489f2b32e1f469650e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cdb463c9aeff4b1d0090647e3baa27f32360301b0be912489f2b32e1f469650e
SHA3-384 hash: 426476d68f40fdd99087e96acc536ffd80819882c65e994e8d35783223e2a1f3eaa2076ed3626e1364dfae877c7781d3
SHA1 hash: 74bd269f5abae4bf05f5e4b092020d699ddfe0bf
MD5 hash: 578e148d0daea951f5b594460918dfd9
humanhash: steak-south-spaghetti-monkey
File name:ORDEN 679564.vbs
Download: download sample
Signature AgentTesla
Create hunting rule
File size:240'064 bytes
First seen:2023-05-24 07:18:09 UTC
Last seen:2023-05-24 07:57:54 UTC
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 1536:XHGd+CKtfSo4+VNmWRWvWFQq2B6LKOYFNai2d:XHGRwf5kWRWvWFQqNdYFk
Threatray 3'638 similar samples on MalwareBazaar
TLSH T17234DD1362E85CC4B1F22A53A8BB55314BFBB9959C3DC94C71C4C769CEE290C98A17E3
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter abuse_ch
Tags:AgentTesla vbs


Avatar
abuse_ch
AgentTesla SMTP exfil server:
beracas.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
128
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/390997/
Detection(s):
SecuriteInfo.com.GT.VB.ObfDldr.1.B934AEC3.1363.21007.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/646dba671211dc2cba6f5497/reports/f6f59254-2b2b-4c3d-9423-8af08d67b5f2/overview
Verdict:
Malicious
Labled as:
GT:VB.ObfDldr.1
Link:
https://www.hybrid-analysis.com/sample/cdb463c9aeff4b1d0090647e3baa27f32360301b0be912489f2b32e1f469650e
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1241443
Signature
Multi AV Scanner detection for submitted file
Suspicious powershell command line found
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 874456 Sample: ORDEN_679564.vbs Startdate: 24/05/2023 Architecture: WINDOWS Score: 64 14 Multi AV Scanner detection for submitted file 2->14 7 wscript.exe 1 2->7         started        process3 signatures4 16 VBScript performs obfuscated calls to suspicious functions 7->16 18 Suspicious powershell command line found 7->18 20 Wscript starts Powershell (via cmd or directly) 7->20 10 powershell.exe 14 14 7->10         started        process5 process6 12 conhost.exe 10->12         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cdb463c9aeff4b1d0090647e3baa27f32360301b0be912489f2b32e1f469650e/
Threat name:
Script-WScript.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-24 07:19:05 UTC
File Type:
Text
AV detection:
6 of 23 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zw2ghsno75fr2aeqmr7dxkrh6mrwama3bpurese7fmzod5djmuha._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0cd219bcf6e303161859a84613942125211d25671ae158f5bd0cc63da22c5b55
AgentTesla
1d016bb63a22f286de2962cb779131d287198d8d7e6250a95a24153d13152ca4
AgentTesla
22cc0f0f7f87f0afd0fd17465e04682c8bc6d868103a09ae9922b39276113d63
AgentTesla
2dda5a5b01e4a02112fbe04d2c7ceea4a7ec0b37c7b4821ae5cb285d22ba6cbd
AgentTesla
32fcd31207c5e310957801fca81578c9dcba9ed3515809f62a7d50d93ad033db
AgentTesla
5f6a89cfb0699f80b756e5b874fab9c80629791dad9e43cc5372e14122fa0b36
AgentTesla
6234c83cf8e46f8e09fed9cbf0456be735dc8640c2df0ee4734b7fa730e0b8eb
AgentTesla
8d146385e353299953a823506c9e9d0aea25715de4ffd94ea46f7e77d79d32e0
AgentTesla
d9577a11fb93cf09c220f70d087e55eb4c7c5fed0537aebd8013e7e01a8d5d15
AgentTesla
e75e7b4f4db640c54deb092dd373afa2b692a2078461cd0193e2b54b84c8250c
AgentTesla
+ 3'628 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230524-h5htxabc56/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://firebasestorage.googleapis.com/v0/b/tttttttt-e4b70.appspot.com/o/new_rump_vb.net.txt?alt=media&token=b27d42df-d877-4be0-ab6a-efe2fee3e2b3
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cdb463c9aeff/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cdb463c9aeff4b1d0090647e3baa27f32360301b0be912489f2b32e1f469650e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_VBS_Wscript_Shell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Visual Basic Script (vbs) vbs cdb463c9aeff4b1d0090647e3baa27f32360301b0be912489f2b32e1f469650e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2639975/
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/390997/

Comments