MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a00b86089979b495ac6e159b6d20ecf063d79b918c31dd79adc1065c9b938d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9a00b86089979b495ac6e159b6d20ecf063d79b918c31dd79adc1065c9b938d9
SHA3-384 hash:	50c365b5994050af0cd9b785918314adc15be8a3658d0c7b6856af0d89dd4b499c13e21920487d92c28e54f32d1b3fb9
SHA1 hash:	f63c7bcb529ff960e2f75441a5f6a2eeee6cf932
MD5 hash:	6c7dd713c80331f920ec45f7d2e0193c
humanhash:	missouri-maine-vegan-ohio
File name:	payment.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	666'547 bytes
First seen:	2023-12-17 10:15:06 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:Zg2n4cYmoSMU7r3eBNYR38Pqwx9mM67KuWMAt9PPQBgElbpGyUVv5ZywHXevYb:Zg2nyHSBnWmEbx67KuU5SxpGyqvTTXn
TLSH	T133E423BF8A0CB4FE5457B60DE7904A10B9AFF8F25F65FD32D18879088E1180226F5666
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla payment zip

cocaman

Malicious email (T1566.001)
From: ""jose.ramirez"<jose.ramirez@expeditors.com>" (likely spoofed)
Received: "from expeditors.com (unknown [91.92.243.208]) "
Date: "15 Dec 2023 07:21:48 -0800"
Subject: "payment slip"
Attachment: "payment.zip"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

205

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	payment.exe
File size:	719'872 bytes
SHA256 hash:	e6370c7eee2c7a1101943e56807d0cac8e977a291385459a4d455d6eb7d821d8
MD5 hash:	18cde9166eb6ab41e877f53875d021bd
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs3369.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.21347.ZipHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/657eca637d4bdb7f8bf60878/reports/a04e8ce2-e91d-4629-8ab2-1e491b6c95a2/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/9a00b86089979b495ac6e159b6d20ecf063d79b918c31dd79adc1065c9b938d9

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/9a00b86089979b495ac6e159b6d20ecf063d79b918c31dd79adc1065c9b938d9

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a00b86089979b495ac6e159b6d20ecf063d79b918c31dd79adc1065c9b938d9/

ReversingLabs TitaniumCloud ByteCode-MSIL.Spyware.Negasteal

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-15 13:41:32 UTC

File Type:

Binary (Archive)

Extracted files:

17

AV detection:

17 of 23 (73.91%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tialqyejs6nuswwg4fm3nuqoz4dd26nzddbr3v423qiglsnzhdmq._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/231217-m4jr2affg3/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9a00b86089979b495ac6e159b6d20ecf063d79b918c31dd79adc1065c9b938d9