MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab95c554ad24a0e65fae5e7827bf05bd669194997fdd9584975cb391749a028a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ab95c554ad24a0e65fae5e7827bf05bd669194997fdd9584975cb391749a028a
SHA3-384 hash:	58b686ee24d44668e9a6f324fe3673a5957135f027ea15046e6713a36afb720bdc7e3f8d2d429498277f95c0b438b025
SHA1 hash:	8537083071d732ab2f0ebcd85d3c9f3e5e960fd2
MD5 hash:	9c4a181aa969c73e4f680031b2790a06
humanhash:	hydrogen-winter-floor-mobile
File name:	Plaston New PO 067476.7z
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	673'437 bytes
First seen:	2024-09-10 10:10:07 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	12288:NhAcV6Y8w8h1/95Y9b+esq/4MhN/u5fbKVmfRJuhOKTjCUoPTZ7V:NucV6Y8wyUK5q/L3m5WmfvuOKTjCUOV5
TLSH	T163E4339A1DE50177588AABF510E1E6FFB20E5CF162A727E83F1CD9E57404E1680E39C8
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	cocaman
Tags:	7z

cocaman

Malicious email (T1566.001)
From: "Shen Ethan <ethan.shen@plaston.cn>" (likely spoofed)
Received: "from plaston.cn (216-131-73-250.iad.as62651.net [216.131.73.250]) "
Date: "10 Sep 2024 03:09:14 -0700"
Subject: "=?UTF-8?B?6K6i5Y2VMDY3NDc2?="
Attachment: "Plaston New PO 067476.7z"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

272

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Plaston New PO 067476.exe
File size:	1'017'856 bytes
SHA256 hash:	b54ee7375e7ea979d16b76f183aaaccfa49681e2bd748ffca202fde9cf823346
MD5 hash:	d30bb9df615a8d1661f843d426ff40eb
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.25544.7zHeur.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66e01b3976bc4542b049535d

Tags:

Execution Generic Infostealer Network Static Stealth Heur

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/ab95c554ad24a0e65fae5e7827bf05bd669194997fdd9584975cb391749a028a/results/dashboard

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/66e01b377fd554a24b9bc875/reports/ed39336f-6bee-4c8b-be7e-d2c39b8fbc33/overview

Hybrid Analysis Mal/Drod7zip

Verdict:

Suspicious

Labled as:

Mal/Drod7zip

Link:

https://www.hybrid-analysis.com/sample/ab95c554ad24a0e65fae5e7827bf05bd669194997fdd9584975cb391749a028a

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/ab95c554ad24a0e65fae5e7827bf05bd669194997fdd9584975cb391749a028a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ab95c554ad24a0e65fae5e7827bf05bd669194997fdd9584975cb391749a028a/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.SuspMsilInArcEmail

Threat name:

ByteCode-MSIL.Trojan.SuspMsilInArcEmail

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-09-10 07:20:38 UTC

File Type:

Binary (Archive)

Extracted files:

43

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vok4kvfnesqomx5olz4cppyfxvtjdfezp7ozlbexlszzc5e2akfa._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla credential_access discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240910-rb4nyswglq/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Credentials from Password Stores: Credentials from Web Browsers

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ab95c554ad24a0e65fae5e7827bf05bd669194997fdd9584975cb391749a028a