MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d62a3c103767f15ab470a20b591eb58d278cd500b5bf53bec7b3cca327f71c21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d62a3c103767f15ab470a20b591eb58d278cd500b5bf53bec7b3cca327f71c21
SHA3-384 hash: d7da7490dc236844f92bcba3af5a047076d3e0a305e2c81652daf40071a6287bbebec34ff525ad036b6c73f0b6cadc37
SHA1 hash: 4ed1dbd9df9e5572448d86cea9be1cefb6d9f6ca
MD5 hash: 58e513d553a1d4748c65f44f36da70b2
humanhash: comet-batman-network-winner
File name:PRODUCT iNQUIRY_SEPTEMBER_0192883.vbs
Download: download sample
Signature AgentTesla
Create hunting rule
File size:312'994 bytes
First seen:2023-08-30 12:29:48 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 6144:fYdXk/3u3su/rKP+DYvrRO6KkWkAk8mMmqmhm8V2:fYdXk/3uLDYvrRO6KkWkAk8mMmqmhm84
Threatray 5'545 similar samples on MalwareBazaar
TLSH T1C764AD1122EE50887273BB835BED75E85F6BF7B21A3A646E211C03174763D64CE69332
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter abuse_ch
Tags:AgentTesla vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/445299/
Detection(s):
SecuriteInfo.com.VBS.Obfuscated-JK.17019.12524.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/64ef3650b3b7d7c782d13f6f/reports/e2bdc04e-161a-4b7e-8547-c042206a5fc6/overview
Verdict:
Suspicious
Labled as:
Trojan.Script.Hworm
Link:
https://www.hybrid-analysis.com/sample/d62a3c103767f15ab470a20b591eb58d278cd500b5bf53bec7b3cca327f71c21
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1300360
Signature
Antivirus detection for URL or domain
Drops VBS files to the startup folder
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Sigma detected: Drops script at startup location
Sigma detected: Powershell download and load assembly
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1300360 Sample: PRODUCT_iNQUIRY_SEPTEMBER_0... Startdate: 30/08/2023 Architecture: WINDOWS Score: 100 54 Malicious sample detected (through community Yara rule) 2->54 56 Antivirus detection for URL or domain 2->56 58 Sigma detected: Drops script at startup location 2->58 60 Sigma detected: Powershell download and load assembly 2->60 8 wscript.exe 1 2->8         started        11 wscript.exe 1 2->11         started        process3 signatures4 64 VBScript performs obfuscated calls to suspicious functions 8->64 66 Suspicious powershell command line found 8->66 68 Wscript starts Powershell (via cmd or directly) 8->68 13 cmd.exe 1 8->13         started        16 powershell.exe 7 8->16         started        70 Very long command line found 11->70 18 cmd.exe 1 11->18         started        20 powershell.exe 11->20         started        process5 signatures6 78 Wscript starts Powershell (via cmd or directly) 13->78 80 Uses ping.exe to sleep 13->80 82 Uses ping.exe to check the status of other devices and networks 13->82 22 cmd.exe 1 13->22         started        25 PING.EXE 1 13->25         started        28 conhost.exe 13->28         started        84 Suspicious powershell command line found 16->84 30 powershell.exe 14 14 16->30         started        32 conhost.exe 16->32         started        34 cmd.exe 1 18->34         started        40 2 other processes 18->40 36 powershell.exe 20->36         started        38 conhost.exe 20->38         started        process7 dnsIp8 62 Wscript starts Powershell (via cmd or directly) 22->62 42 powershell.exe 9 22->42         started        50 127.0.0.1 unknown unknown 25->50 52 uploaddeimagens.com.br 188.114.97.7, 443, 49721, 49740 CLOUDFLARENETUS European Union 30->52 46 powershell.exe 9 34->46         started        signatures9 process10 file11 48 C:\Users\user\AppData\Roaming\...\Xf.vbs, Unicode 42->48 dropped 72 Suspicious powershell command line found 42->72 74 Drops VBS files to the startup folder 42->74 76 Found suspicious powershell code related to unpacking or dynamic code loading 42->76 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d62a3c103767f15ab470a20b591eb58d278cd500b5bf53bec7b3cca327f71c21/
Threat name:
Script-WScript.Trojan.Minerva
Create hunting rule
Status:
Malicious
First seen:
2023-08-30 12:30:08 UTC
File Type:
Text (VBS)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2yvdyebxm7yvvndquifvshvvrutyzviaww7vhpwhwpgkgj7xdqqq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3f92752540e0658dc96fef662e8f96f9552383c8b8da50ea7707b35727a645de
AgentTesla
5fae7963422c008476f909d056af0c5436eee0266bba7f4ddb42584324cc6c3c
AgentTesla
60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623
AgentTesla
878cf34c962c82b64a18d1100d4182b933b4a63a9940d7c2d998a4f93f267ae5
AgentTesla
a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509
AgentTesla
b9a72ccaad2c22150062d59d79744e1ab3aa5a106aa0837bdde9e05ccb39c91e
AgentTesla
be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf
AgentTesla
e9030808d9eb24aba0aa124faebeecaa515b498d738bdb30414af6a15dc98120
AgentTesla
f2688472718a5b0be3b64d7eb647620e18bf5ced25c01bba5e02c54cb9fb07bf
AgentTesla
+ 5'535 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230830-ppgegaee3v/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Drops startup file
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d62a3c103767/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/d62a3c103767f15ab470a20b591eb58d278cd500b5bf53bec7b3cca327f71c21

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/445299/

Comments