MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd9d4b54d7ad239a6c2802cedf6829288d1230d6dceea93324ff64feb625f3bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dd9d4b54d7ad239a6c2802cedf6829288d1230d6dceea93324ff64feb625f3bd
SHA3-384 hash:	59509a36844fe375e13ce4ab18e6ab50d5ca372192afb9c7ab11616c0e861fff88a59c127a94dfd23eeb99f77a6f5757
SHA1 hash:	941580cd173fc694feedd8d6a5b375274ff00ccd
MD5 hash:	b0a6c96620f1f43dc68d96556fe9a648
humanhash:	nineteen-emma-speaker-nineteen
File name:	PO 0130717.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	635'354 bytes
First seen:	2023-12-15 08:36:57 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:Zn1qCszgb6+gTCT/q4pIlWChQHioalmHK0+CaWPUpb6QZi20aMxsJ4:Z1q3zegApMhQqPZCJUpb6Ws04
TLSH	T1B0D4231F1AD0BD71D650C20967D07C36CE6E0461BDD123FFAA05BD5A272FE4A668218F
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: "Allen-wang@united-steel.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.107]) "
Date: "14 Dec 2023 04:22:21 +0100"
Subject: "AW: Order Signed contract and PO"
Attachment: "PO 0130717.zip"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

162

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	PO 0130717.exe
File size:	657'408 bytes
SHA256 hash:	961501b7f2e2ba7d255fc9cc4de8dfd0697dd2265c2e4e316f92854166614c31
MD5 hash:	d4d674166a7ab5db6765d5f1db8ae363
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.13925.10316.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/657c102fffafd83ebc9088de/reports/f05559ba-7a8e-4a62-9151-99ac4cdcd426/overview

Hybrid Analysis Troj/Krypt

Verdict:

Malicious

Labled as:

Troj/Krypt

Link:

https://www.hybrid-analysis.com/sample/dd9d4b54d7ad239a6c2802cedf6829288d1230d6dceea93324ff64feb625f3bd

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/dd9d4b54d7ad239a6c2802cedf6829288d1230d6dceea93324ff64feb625f3bd

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/dd9d4b54d7ad239a6c2802cedf6829288d1230d6dceea93324ff64feb625f3bd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dd9d4b54d7ad239a6c2802cedf6829288d1230d6dceea93324ff64feb625f3bd/

ReversingLabs TitaniumCloud Win32.Trojan.AgentTesla

Threat name:

Win32.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-14 03:15:29 UTC

File Type:

Binary (Archive)

Extracted files:

8

AV detection:

22 of 37 (59.46%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3wouwvgxvurzu3bialhn62bjfcgremgw3txksmze75sp5nrf6o6q._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231215-kkwldadad7/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dd9d4b54d7ad239a6c2802cedf6829288d1230d6dceea93324ff64feb625f3bd