MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9030808d9eb24aba0aa124faebeecaa515b498d738bdb30414af6a15dc98120. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9030808d9eb24aba0aa124faebeecaa515b498d738bdb30414af6a15dc98120
SHA3-384 hash: 47f718a3e92414634bccc6333b2477fc325a8a68dbf83ac010ec44ad8e0bd24c6981e1dba162f91a7e47ca199631861d
SHA1 hash: 03f92cdcfb008c2799b54fc9ac9971e8773fe771
MD5 hash: 18a4d7b53fe2eaaf191336f70c40e7b9
humanhash: grey-alabama-texas-jersey
File name:qasx(1).vbs
Download: download sample
Signature AgentTesla
Create hunting rule
File size:325'488 bytes
First seen:2023-08-17 18:50:20 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 6144:l0ToVlYjnnRHMxzakHd8S6QHHmsHHCH+gQGFHdRwaOCnvWUq6QHHHHRmlknCA0wd:l0ToVlYjhMxzakHd8S6QHHmsHHCH+gQx
Threatray 4'007 similar samples on MalwareBazaar
TLSH T10364BB01A6EF4148B2B37F465BF964E98F27BA91163E985D204C170F8BE7E408D52B73
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter malwarelabnet
Tags:AgentTesla vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
CA CA
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/443343/
Detection(s):
SecuriteInfo.com.VBS.Obfuscated-JF.27229.19636.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
Labled as:
Trojan.Script.Hworm
Link:
https://www.hybrid-analysis.com/sample/e9030808d9eb24aba0aa124faebeecaa515b498d738bdb30414af6a15dc98120
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1293044
Signature
Antivirus detection for URL or domain
Drops VBS files to the startup folder
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1293044 Sample: qasx(1).vbs Startdate: 17/08/2023 Architecture: WINDOWS Score: 100 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus detection for URL or domain 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 Sigma detected: Drops script at startup location 2->62 8 wscript.exe 1 2->8         started        11 wscript.exe 1 2->11         started        process3 signatures4 66 VBScript performs obfuscated calls to suspicious functions 8->66 68 Suspicious powershell command line found 8->68 70 Wscript starts Powershell (via cmd or directly) 8->70 13 cmd.exe 1 8->13         started        16 powershell.exe 5 8->16         started        72 Very long command line found 11->72 18 cmd.exe 1 11->18         started        20 powershell.exe 11->20         started        process5 signatures6 80 Wscript starts Powershell (via cmd or directly) 13->80 82 Uses ping.exe to sleep 13->82 84 Uses ping.exe to check the status of other devices and networks 13->84 22 cmd.exe 1 13->22         started        25 PING.EXE 1 13->25         started        28 conhost.exe 13->28         started        86 Suspicious powershell command line found 16->86 30 powershell.exe 14 16 16->30         started        32 conhost.exe 16->32         started        34 cmd.exe 1 18->34         started        40 3 other processes 18->40 36 powershell.exe 20->36         started        38 conhost.exe 20->38         started        process7 dnsIp8 64 Wscript starts Powershell (via cmd or directly) 22->64 42 powershell.exe 9 22->42         started        50 127.0.0.1 unknown unknown 25->50 52 80.76.51.248, 49735, 49736, 80 CLOUDCOMPUTINGDE Bulgaria 30->52 46 powershell.exe 9 34->46         started        54 uploaddeimagens.com.br 188.114.97.7, 443, 49733, 49734 CLOUDFLARENETUS European Union 36->54 signatures9 process10 file11 48 C:\Users\user\AppData\Roaming\...\POX.vbs, Unicode 42->48 dropped 74 Suspicious powershell command line found 42->74 76 Drops VBS files to the startup folder 42->76 78 Found suspicious powershell code related to unpacking or dynamic code loading 42->78 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9030808d9eb24aba0aa124faebeecaa515b498d738bdb30414af6a15dc98120/
Threat name:
Script-WScript.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-08-17 18:51:06 UTC
File Type:
Text (VBS)
AV detection:
1 of 38 (2.63%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ebqqcgz5mskxifkcjh25pxmvjivwsmnoof5wmcbjl3kcxojqeqa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0208bd67126a78dbb0fa2f7ddc65495796a6228d4b31f60de86acdc5bcd1e1d8
AgentTesla
3f92752540e0658dc96fef662e8f96f9552383c8b8da50ea7707b35727a645de
AgentTesla
60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623
AgentTesla
a06f443a1ca6cbaf9e8cd3a2ff0e7ec0d982d654709e952fc68621450926c509
AgentTesla
b9a72ccaad2c22150062d59d79744e1ab3aa5a106aa0837bdde9e05ccb39c91e
AgentTesla
ba426d437309667874833f60de7397597e17a6daa59fac280cbe6bed820195dc
AgentTesla
be153a4036bff7a16febb0821fa79f035bfaed137c0c2a999fcd33e04859a7cf
AgentTesla
cdb463c9aeff4b1d0090647e3baa27f32360301b0be912489f2b32e1f469650e
AgentTesla
d016ca7d62e88fc7df80866588b24d324b6671a23ad0e7159a17677a07a5ac45
AgentTesla
ebb35d31b8c44c163ecaadef47d7f6249cc1d2c654fa5afb1011ea1527fea927
AgentTesla
+ 3'997 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230817-xhgewsea31/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops startup file
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e9030808d9eb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/e9030808d9eb24aba0aa124faebeecaa515b498d738bdb30414af6a15dc98120

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Visual Basic Script (vbs) vbs e9030808d9eb24aba0aa124faebeecaa515b498d738bdb30414af6a15dc98120

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2700258/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/443343/

Comments