MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb1cd5d1a4d9bfef47ef20f4bc09e01c9b515c55f95c05838d1e2b461b3ca270. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bb1cd5d1a4d9bfef47ef20f4bc09e01c9b515c55f95c05838d1e2b461b3ca270
SHA3-384 hash:	d34433b6b98a8613fdf8dd370f7382fdd5b8b69aead10d9b62f5ab6f6fe610bab60874bca5aebe568f8252b09eaec858
SHA1 hash:	32788df0eace9130f0ac60d44a03de5b795eeb0a
MD5 hash:	5f71861fcd218651a329bab9639b36af
humanhash:	missouri-double-timing-asparagus
File name:	Outstanding Invoice For PI9128.rar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	756'742 bytes
First seen:	2023-12-17 07:55:16 UTC
Last seen:	2023-12-18 06:45:08 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:aVVs7gek1K22J7z/H7qukeDg7Y5tRs2p86TpOiW75jfq2L8RhGXFxccFGWLj:ZczKZjq0DltmW86gi25eu8axccFGWv
TLSH	T12FF4337E188860F0ADDE0A56B5D3796E56330285F2C8DC37FC4332569A9DA2963D07F2
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla INVOICE rar

cocaman

Malicious email (T1566.001)
From: ""chester.chu" <chester.chu@ydfvalve.com>" (likely spoofed)
Received: "from ydfvalve.com (unknown [45.137.22.230]) "
Date: "18 Dec 2023 02:31:16 +0100"
Subject: "Fw: Re: Outstanding Invoice For PI9128"
Attachment: "Outstanding Invoice For PI9128.rar"

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

112

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Outstanding Invoice For PI9128.exe
File size:	922'112 bytes
SHA256 hash:	0e8d62cb92dbe0787e14f847eaf79e1c136bc20480ece480e0cde84c084ef02b
MD5 hash:	8e390b9f9731ad667723669c9a5a0ab3
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/bb1cd5d1a4d9bfef47ef20f4bc09e01c9b515c55f95c05838d1e2b461b3ca270/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/657ea993a6bc59352f2aba8a/reports/f624cf09-046d-4242-b263-e5932384cfee/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/bb1cd5d1a4d9bfef47ef20f4bc09e01c9b515c55f95c05838d1e2b461b3ca270

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb1cd5d1a4d9bfef47ef20f4bc09e01c9b515c55f95c05838d1e2b461b3ca270/

ReversingLabs TitaniumCloud Win32.Spyware.Negasteal

Threat name:

Win32.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-15 11:19:25 UTC

File Type:

Binary (Archive)

Extracted files:

33

AV detection:

19 of 37 (51.35%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xmonlune3g766r7ped2lycpadsnvcxcv7foala4ndyvumgz4ujya._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231217-kmklwseagq/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Checks computer location settings

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bb1cd5d1a4d9bfef47ef20f4bc09e01c9b515c55f95c05838d1e2b461b3ca270