MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 811b146b2f6bee669198189c45a30ab94be95a7a74d6ff0b8798d9f828be0aa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	811b146b2f6bee669198189c45a30ab94be95a7a74d6ff0b8798d9f828be0aa9
SHA3-384 hash:	abdc8f9737c8f653208c7492c3f85358277f494f91d68e51e83703ea5d9a257245b3b0b18cc19cbab81c6453a0453963
SHA1 hash:	44411ce037ef4c1751d3f2f45d978228edb5a0d6
MD5 hash:	0807461cf0e61b1f4c7069785c03a6d2
humanhash:	cold-table-steak-asparagus
File name:	payment.rar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	697'285 bytes
First seen:	2023-12-18 15:17:07 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:RWDfgvMvI3Ez4X4PwAX3oSF4R89kyt42Y/dQTe9M2nMc2LsIU:RjMiHOwK3oSFak2F9724t
TLSH	T1B9E423C3428117D09A54EC3D232A4A8DEB9AD8CB621E51A88F05C7F99816FFF76D7C50
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla payment rar

cocaman

Malicious email (T1566.001)
From: ""jose.ramirez"<jose.ramirez@expeditors.com>" (likely spoofed)
Received: "from expeditors.com (unknown [91.92.243.208]) "
Date: "18 Dec 2023 07:16:41 -0800"
Subject: "payment slip"
Attachment: "payment.rar"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

100

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	payment.exe
File size:	944'128 bytes
SHA256 hash:	e0b8c5c5f1fcfd52dffabc78f9ce5dedc8598ec30736ec30308cf5b2d4dc4801
MD5 hash:	c29abab6768852ca893ad2ddf7243e40
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/811b146b2f6bee669198189c45a30ab94be95a7a74d6ff0b8798d9f828be0aa9/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/658062ad6b1c246046fa60f8/reports/29361a5e-22e2-4c22-9095-d07a9e556e46/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/811b146b2f6bee669198189c45a30ab94be95a7a74d6ff0b8798d9f828be0aa9

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/811b146b2f6bee669198189c45a30ab94be95a7a74d6ff0b8798d9f828be0aa9/

ReversingLabs TitaniumCloud Win32.Spyware.Negasteal

Threat name:

Win32.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 08:19:11 UTC

File Type:

Binary (Archive)

Extracted files:

10

AV detection:

21 of 36 (58.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qenri2zpnpxgnemydcoeliykxff6swt2otlp6c4htdm7qkf6bkuq._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/231218-twcgbadbf2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/811b146b2f6bee669198189c45a30ab94be95a7a74d6ff0b8798d9f828be0aa9