MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54f193937bba8dced8a9851b697a533f73261aa0761140e5d5190ad5525da90c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	54f193937bba8dced8a9851b697a533f73261aa0761140e5d5190ad5525da90c
SHA3-384 hash:	bdd25f81269ad0a03a82b148da9983d3f0b71ba11588753ee3ecc314d42b655aef0fffb49d2a53562d90e0aaa8b8c892
SHA1 hash:	14c5d7271dff29534b5e8b53f7471e98229731ed
MD5 hash:	9082bd6f74519a57cd175b303b0012f6
humanhash:	coffee-mockingbird-crazy-river
File name:	PO INS 0124.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	720'549 bytes
First seen:	2023-12-19 19:29:44 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:3HtXh0NZRn/aG+8Jjt5wqj8x07axT/tGO3rpHUUoZnUIE3LIrYq+LgTGvfEDtGuf:9REZ9aG+8Brjk07aXnNRahE3a+kTGvfi
TLSH	T137E433CEEC5B3532CD93B211904AF4CB74F1FE6D462947F9346823764F2AA482D7AA50
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: ""Sealock Jane" sealock8@sealock.com.hk" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.165]) "
Date: "19 Dec 2023 20:29:06 +0100"
Subject: "NEW PURCHASE ORDER PO INS 0124"
Attachment: "PO INS 0124.zip"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

218

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	PO INS 0124.exe
File size:	948'224 bytes
SHA256 hash:	0ca7d41fee3a2830bf3c46fad06e838fa2f3a362a3f62f58f1b3f0176146ddc3
MD5 hash:	5ffe3572f2313169024f1eb5547ad331
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6581ef3dd48681e0d663316a/reports/dc629891-e362-4734-a36e-ed2588b7a699/overview

Hybrid Analysis Troj/Krypt

Verdict:

Malicious

Labled as:

Troj/Krypt

Link:

https://www.hybrid-analysis.com/sample/54f193937bba8dced8a9851b697a533f73261aa0761140e5d5190ad5525da90c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/54f193937bba8dced8a9851b697a533f73261aa0761140e5d5190ad5525da90c

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/54f193937bba8dced8a9851b697a533f73261aa0761140e5d5190ad5525da90c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/54f193937bba8dced8a9851b697a533f73261aa0761140e5d5190ad5525da90c/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-19 18:46:49 UTC

File Type:

Binary (Archive)

Extracted files:

13

AV detection:

16 of 37 (43.24%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ktyzhe33xkg45wfjqunws6sth5zsmgvaoyiubzovdefnkus5vega._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/54f193937bba8dced8a9851b697a533f73261aa0761140e5d5190ad5525da90c