MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd4a6bb436e33a55b18f88a38f23ea82b1f4d80cb170eeb7e1de6797b9ce59dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dd4a6bb436e33a55b18f88a38f23ea82b1f4d80cb170eeb7e1de6797b9ce59dc
SHA3-384 hash:	1fc7292ae38e82aa2cc9671ac2cc3439ad17cd072699d2e13a269b9b04d99d0a02f3e04b1f4151d71be2a783ffd3a8ac
SHA1 hash:	f73db63b367fa65f0f18c16b486cbe1fb7a09175
MD5 hash:	53e7ff417abe87f64279f3372d5867a0
humanhash:	west-speaker-arkansas-eleven
File name:	a5735832824ae3edccb33bcf84be65e24a7cd74c9b4f809bb6544a74.vbs
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	397'380 bytes
First seen:	2023-10-23 04:06:30 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	12288:0m6ieTpk4K282PPNbs5ySqa5ssHaXTVUibX5Sqa5IEfpQBSoX6c6Z+Q:v6ieTHK282Nbs5yBa5ssHaXT5bX5Ba5J
Threatray	654 similar samples on MalwareBazaar
TLSH	T181842A2435EF640C72B37F621FE8B9D94EAFFBA11A2A655E215407078A53D40CFA1732
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	r3dbU7z
Tags:	AgentTesla vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

115

Origin country :

RU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfuscated-KJ.29999.23872.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

sload

Link:

https://www.filescan.io/uploads/6535f168e3768e7905c6e662/reports/2832b440-aa4a-472f-89dc-967550900a63/overview

Hybrid Analysis Valyria

Verdict:

Malicious

Labled as:

Valyria

Link:

https://www.hybrid-analysis.com/sample/dd4a6bb436e33a55b18f88a38f23ea82b1f4d80cb170eeb7e1de6797b9ce59dc

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla, zgRAT

Result

Threat name:

AgentTesla, zgRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1330276

Signature

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell download and load assembly

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected Generic Downloader

Yara detected Telegram RAT

Yara detected zgRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

ASCII

Link:

https://malprob.io/report/dd4a6bb436e33a55b18f88a38f23ea82b1f4d80cb170eeb7e1de6797b9ce59dc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dd4a6bb436e33a55b18f88a38f23ea82b1f4d80cb170eeb7e1de6797b9ce59dc/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Valyria

Threat name:

Script-WScript.Trojan.Valyria

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-20 19:35:26 UTC

File Type:

Text (VBS)

AV detection:

6 of 23 (26.09%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3vfgxnbw4m5flmmprcry6i7kqky7jwamwfyo5n7b3ztzpooolhoa._file

Threatray malicious

Verdict:

malicious

Similar samples:

11e812da55ed18d2337cf3249cf00df14fd1442f1914dcd177eb36df329d3e2e

AgentTesla

1acf61ab5912011c1e3bed1fc4bca2b17f1d9098245976415e2d8d40ee3e472e

AgentTesla

5d7d1ac4ea18ac47a6a78b81e3bf144aa1dfaf693239239c7a8521b800d810f4

AgentTesla

5dde21be9d6b2fffde1eeab3dd6fc370bf6c47f047d9dc7e16c5e9f0ead13b96

AgentTesla

b2a66c29e74c2c3115c7fa7f07694dfea64957d6701c5c9b54d9b9a14abd8462

AgentTesla

cd4f4252279410bc08ab3f37cb032a87c0c98077c4fc9981266a9964c37274a9

AgentTesla

d3ee013d6d3189698f86f7bf10bac7d49ae944d574e40f6f0888d702d52fcd18

AgentTesla

e6b6f23895185671a91e377fb4a48b3cd934092daf0409559e0f5c7f22949c5f

AgentTesla

+ 644 additional samples on MalwareBazaar

Hatching Triage zgrat

Result

Malware family:

zgrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:zgrat rat

Link:

https://tria.ge/reports/231023-epmw5sfg86/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Detect ZGRat V1

ZGRat

Malware Config

Dropper Extraction:

https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dd4a6bb436e3/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.