MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0101acdf0cdb39f07a8157fd6b6d515fc7ff8a238d600fd695074df57404d73a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0101acdf0cdb39f07a8157fd6b6d515fc7ff8a238d600fd695074df57404d73a
SHA3-384 hash:	ebdb79db2c9bd669af514f4436828ce779f1ed3bc19130098676e32e72408f47650481e0c86f453f7eb62b461fac6cc4
SHA1 hash:	06a65135976dcf8a677120b260b4361288ef3b30
MD5 hash:	62e7ca46da56862cdcb1c9233e5507d6
humanhash:	july-happy-orange-quiet
File name:	PRE ALERT NOTICE.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	640'841 bytes
First seen:	2023-12-15 11:07:37 UTC
Last seen:	2023-12-17 10:10:51 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:hDZyKHcBGnpB/hhNuVI07vfb/756n96WHCOLo57lsN5PWfTmQTIlGPJRA5/SX7Vo:xZuGpBvN444WHCr7mN5PWrm1GPPA5SX6
TLSH	T150D423C2EE304310057272A591ABD71A207CB9D1C7CEE56C2FADEAA3E7FD51136526C2
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla Shipping zip

cocaman

Malicious email (T1566.001)
From: "Ash Zhang(Mr)<ash.zhang@ugslogistics.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.107]) "
Date: "15 Dec 2023 15:10:59 +0100"
Subject: "Re: Final Shipping Documents"
Attachment: "PRE ALERT NOTICE.zip"

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

173

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	PRE ALERT NOTICE.exe
File size:	661'504 bytes
SHA256 hash:	6a925c2569b45a9199d08453915475565d5ea13788bb12ede9102c370f8bce0f
MD5 hash:	323725dcd46636345f8d2aae36c1cd96
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs3462.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Rogue.0hr.20231215-0934.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/657c3392b855eb3693dd2375/reports/311a9293-3ba1-4d8b-80e6-e726bd6373bc/overview

Hybrid Analysis Troj/MSIL

Verdict:

Malicious

Labled as:

Troj/MSIL

Link:

https://www.hybrid-analysis.com/sample/0101acdf0cdb39f07a8157fd6b6d515fc7ff8a238d600fd695074df57404d73a

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/0101acdf0cdb39f07a8157fd6b6d515fc7ff8a238d600fd695074df57404d73a

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

Archive

Link:

https://malprob.io/report/0101acdf0cdb39f07a8157fd6b6d515fc7ff8a238d600fd695074df57404d73a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0101acdf0cdb39f07a8157fd6b6d515fc7ff8a238d600fd695074df57404d73a/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-15 11:07:40 UTC

File Type:

Binary (Archive)

Extracted files:

8

AV detection:

20 of 37 (54.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aea2zxym3m47a6ubk76ww3krl7d77crdrvqa7vuva5g7k5ae245a._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231215-sn192afag9/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0101acdf0cdb39f07a8157fd6b6d515fc7ff8a238d600fd695074df57404d73a