MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 468f75017a1189597352fa75f68466b4c381ffd0cb39449492c61fce755d88e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	468f75017a1189597352fa75f68466b4c381ffd0cb39449492c61fce755d88e4
SHA3-384 hash:	8e02a466b36b4987be7d8293e56c9c3de88ac23017798905fd2f21de5c1b40dfb235292d796b48278187d394d6860ad2
SHA1 hash:	d72a0d6ebe85ff207d2d587af4f9312b8e7ebb55
MD5 hash:	cbfc00fe443d77a41cfdbf338e64150f
humanhash:	apart-autumn-freddie-september
File name:	catalog.uue
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	520'750 bytes
First seen:	2023-06-26 13:53:08 UTC
Last seen:	Never
File type:	uue
MIME type:	application/x-rar
ssdeep	12288:F1j2gGgOuyvupZypK1IsLdYULWq3I3Pb8XUS:bKH/hsLK9dfbLS
TLSH	T1D0B4239B94094839B0A9EE944AD9BD79821CCB52D7A8339ED45387401DB9F30F839D3F
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla uue

cocaman

Malicious email (T1566.001)
From: "=?UTF-8?B?RWxpemFiZXRoIE3DqW5kZXogSGVybsOhbmRleg==?= <ventas1@ssyt.com.mx>" (likely spoofed)
Received: "from ssyt.com.mx (unknown [45.137.22.146]) "
Date: "26 Jun 2023 15:52:10 +0200"
Subject: "FW: Article catalog..."
Attachment: "catalog.uue"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

143

Origin country :

CH

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6499987b76927ec2c007a2d6/reports/adfe7bbe-f48b-4f99-915f-773a637b9d31/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/468f75017a1189597352fa75f68466b4c381ffd0cb39449492c61fce755d88e4

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/468f75017a1189597352fa75f68466b4c381ffd0cb39449492c61fce755d88e4/

ReversingLabs TitaniumCloud Win32.Spyware.Negasteal

Threat name:

Win32.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-26 07:46:57 UTC

File Type:

Binary (Archive)

Extracted files:

9

AV detection:

20 of 37 (54.05%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i2hxkal2cgevs42s7j27nbdgwtbyd76qzm4ujfesyyp445k5rdsa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/468f75017a1189597352fa75f68466b4c381ffd0cb39449492c61fce755d88e4