MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1f09f50a794fd933b208be4a409e5149fd03ba8dc3516ed804348e5baf482c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e1f09f50a794fd933b208be4a409e5149fd03ba8dc3516ed804348e5baf482c2
SHA3-384 hash:	92b468ea29319eb39d83c8bb24baabcf2b62c775b8eb865f280c5cdca9eea513027f84d063b6b6d0a86c39df61560b3d
SHA1 hash:	503ea7c6f22f014c9aa0ea79df04172fc3c217b1
MD5 hash:	2ca3f9c8fb1c767d3a066e3deea29029
humanhash:	march-cola-solar-hydrogen
File name:	PO INS 0124.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	697'659 bytes
First seen:	2023-12-19 08:49:15 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:m8sYPSHPmFEnYLaBC7cN46FT/cZXaZwENPFmoI1mVBSAyPTZ:mYaHP6EnrBC7cNXZUUbNNmo2mzS5Z
TLSH	T1C9E4232063BFAE862631C41450F9EA04D4FC456F95D4231FF67FA913E9A3F902806E79
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: ""Sealock Jane" sealock8@sealock.com.hk" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.165]) "
Date: "18 Dec 2023 22:10:07 +0100"
Subject: "NEW PURCHASE ORDER PO INS 0124"
Attachment: "PO INS 0124.zip"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

204

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	PO INS 0124.exe
File size:	936'960 bytes
SHA256 hash:	0eed254ba5c7e7cc2b6ac08be4b1a450d453b58ed58d5b23caed7fb0db89961a
MD5 hash:	76253e7ea3523aa5468177784587ee07
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6581593b7d4bdb7f8bf7b01d/reports/989c5185-a973-4a58-ba20-9e7873a82189/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/e1f09f50a794fd933b208be4a409e5149fd03ba8dc3516ed804348e5baf482c2

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/e1f09f50a794fd933b208be4a409e5149fd03ba8dc3516ed804348e5baf482c2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e1f09f50a794fd933b208be4a409e5149fd03ba8dc3516ed804348e5baf482c2/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 12:08:02 UTC

File Type:

Binary (Archive)

Extracted files:

9

AV detection:

18 of 37 (48.65%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4hyj6ufhst6zgozarpskicpfcsp5ao5i3q2rn3maineoloxuqlba._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/231219-qfg53sdbf8/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e1f09f50a794fd933b208be4a409e5149fd03ba8dc3516ed804348e5baf482c2