MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51cf9f85e81dd5073791de0b1a763e2702faf95aa30ba4f879d704b24eaf7e56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	51cf9f85e81dd5073791de0b1a763e2702faf95aa30ba4f879d704b24eaf7e56
SHA3-384 hash:	9acd559b440a25d7dd55c936efefacc08525be1a2485e95b495bde74579882a100b6391bb381b9d91d512e2a100274cd
SHA1 hash:	6bd8c97f63f9e8a8734a7976d700ed41363c51af
MD5 hash:	dcfae0202a40716e471021ab97fc6e29
humanhash:	oklahoma-apart-pip-speaker
File name:	payment slip.rar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	693'811 bytes
First seen:	2023-12-18 13:54:04 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:LG1asnVz3P4dLRukHevuvyM7N2hVq2FZlr3a/SFfaEytFQ+W1qV0G:LGYK/4d1ugpN2hJZ9RfaJtFQrcV0G
TLSH	T127E433CD143F2E4327D90AA8E2EFB532E46F6D538105D2BAC5D68E1BD4D072075ACBA4
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla DHL payment rar

cocaman

Malicious email (T1566.001)
From: ""lyla Wang (SZX GTW) (DHL CN)"<lyla.wang@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [91.92.243.208]) "
Date: "18 Dec 2023 05:53:45 -0800"
Subject: "Re: Remittance Advice USD 758,678.89"
Attachment: "payment slip.rar"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

106

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	payment slip.exe
File size:	939'520 bytes
SHA256 hash:	fe631848ec9e5b0eb6675e44eee3d3bfc17bc4c2a1669842ab02303e748a85e7
MD5 hash:	b647085602dc692a7832f58ce040bc2a
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/51cf9f85e81dd5073791de0b1a763e2702faf95aa30ba4f879d704b24eaf7e56/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/65804f39314dbc3b9b58e989/reports/0695bfbf-c01b-48f6-88d7-10aa972e064e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/51cf9f85e81dd5073791de0b1a763e2702faf95aa30ba4f879d704b24eaf7e56

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/51cf9f85e81dd5073791de0b1a763e2702faf95aa30ba4f879d704b24eaf7e56/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 07:30:09 UTC

File Type:

Binary (Archive)

Extracted files:

9

AV detection:

14 of 23 (60.87%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=khhz7bpidxkqon4r3yfru5r6e4bpv6k2umf2j6dz24cletvppzla._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/231218-seflzabcem/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/51cf9f85e81dd5073791de0b1a763e2702faf95aa30ba4f879d704b24eaf7e56