MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5e2af1b8ea169231817c1ed9b9252b50e0e1f27f91fa3b56c98da8c03568563. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e5e2af1b8ea169231817c1ed9b9252b50e0e1f27f91fa3b56c98da8c03568563
SHA3-384 hash:	ad9041f8d84dad7678cab9b7a74318dc2a1d2a56cd9bbdc6bb92bcb0bb6ccda15f54d154d76503312f9b33f5d7158219
SHA1 hash:	5fa6fc3acba80c98d1a0c9f0ca3f4d89ce10bad0
MD5 hash:	000d01e211206849d431279c64aa17fb
humanhash:	summer-sodium-six-bakerloo
File name:	Payment.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	612'007 bytes
First seen:	2023-12-22 07:23:49 UTC
Last seen:	2023-12-22 07:24:20 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:4rLooQUZp5JGb/4SoJHKbeXRLCtSVGNx+vLm/EfTNSCP:yHQUZp5m4SoJHKbwhwN5cpSCP
TLSH	T17AD423D253E1381737BC0BA753AF9327B83910990386D1CCBBBD7754278879C4269ACA
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla INVOICE payment zip

cocaman

Malicious email (T1566.001)
From: "Tiwell <tiwell506@vip.163.com>" (likely spoofed)
Received: "from vip.163.com (unknown [91.92.242.244]) "
Date: "22 Dec 2023 03:30:14 +0100"
Subject: "TAX INVOICE AND CONTRACT DOCUMENT"
Attachment: "Payment.zip"

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

171

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Payment.exe
File size:	894'464 bytes
SHA256 hash:	d9c3810761942c6191a8e2dfb22b2178d6970bf474a908a4af1bc80b3022a774
MD5 hash:	0d6903937d99f589999fe92abdf3dfa4
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs3369.UNOFFICIAL

Alert

Create hunting rule

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.Inject4.59820.1924.26410.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.21669.ZipHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/65853995eabaed0701724109/reports/2ed42650-1ae0-4fb7-b3f7-ec81f2483f0b/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/e5e2af1b8ea169231817c1ed9b9252b50e0e1f27f91fa3b56c98da8c03568563

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/e5e2af1b8ea169231817c1ed9b9252b50e0e1f27f91fa3b56c98da8c03568563

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/e5e2af1b8ea169231817c1ed9b9252b50e0e1f27f91fa3b56c98da8c03568563

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5e2af1b8ea169231817c1ed9b9252b50e0e1f27f91fa3b56c98da8c03568563/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 20:16:44 UTC

File Type:

Binary (Archive)

Extracted files:

17

AV detection:

24 of 37 (64.86%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4xrk6g4oufusggaxyhwzxesswuha4hzh7ep2hnlmtdniya2wqvrq._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231222-jn9fzacehl/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Looks up external IP address via web service

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e5e2af1b8ea169231817c1ed9b9252b50e0e1f27f91fa3b56c98da8c03568563