MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a712870a2130aa24fed35fbc5ff8a102c658826c5ef18b9b4a8378447dce36e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5a712870a2130aa24fed35fbc5ff8a102c658826c5ef18b9b4a8378447dce36e
SHA3-384 hash:	8ff6e7eea7c6602ff9137354f32aa54d5f5c6592f6de8c8671822ee4d2ea9926175b4a1097b7cfa24cf38b4492423228
SHA1 hash:	11da75f39a13787febf41e6323d890f6b27c8e43
MD5 hash:	616075cd1b543434cf4d35606a3f5665
humanhash:	jig-social-juliet-river
File name:	Outstanding Invoice For PI91128.001
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	969'420 bytes
First seen:	2023-12-18 11:25:33 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:rwk1bddEZOhsoWQc2KF8ul8lwqHH95Gv9WIsGayy9i:8kreZOhsw46u/qHd5k9WkOi
TLSH	T1762502B60E2ED819D6913CBE6513C6982FB8D0122B1CF389DAE15DEF79ED39168C5043
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	001 AgentTesla INVOICE zip

cocaman

Malicious email (T1566.001)
From: ""chester.chu" <chester.chu@ydfvalve.com>" (likely spoofed)
Received: "from ydfvalve.com (unknown [45.137.22.230]) "
Date: "18 Dec 2023 12:24:17 +0100"
Subject: "Fw: Re: Outstanding Invoice For PI9128"
Attachment: "Outstanding Invoice For PI91128.001"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

200

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Outstanding Invoice For PI91128.exe
File size:	969'216 bytes
SHA256 hash:	4a0a2c6bf6a863c1c56fb7b6657fd8cd60369e03fb40d8634eb5ee37d8575390
MD5 hash:	19b63cba1326e939bac9efdb146f5d31
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fn16.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/65802c5003487a0d25d3a341/reports/9764d858-001a-4d7d-b1f9-6e427a11f670/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5a712870a2130aa24fed35fbc5ff8a102c658826c5ef18b9b4a8378447dce36e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5a712870a2130aa24fed35fbc5ff8a102c658826c5ef18b9b4a8378447dce36e/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 11:25:36 UTC

File Type:

Binary (Archive)

Extracted files:

26

AV detection:

13 of 37 (35.14%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ljysq4fccmfket7ngx54l74kcawglcbgyxxrronuva3yir644nxa._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231218-nlj6hsbfg8/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Checks computer location settings

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5a712870a2130aa24fed35fbc5ff8a102c658826c5ef18b9b4a8378447dce36e