MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1b5b9880b50454748e9034fa6942f85daed1d7fbf4bf6cf8bbeef514c7b34d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f1b5b9880b50454748e9034fa6942f85daed1d7fbf4bf6cf8bbeef514c7b34d3
SHA3-384 hash:	ef7b6029382720a8e2a7958a89ad5391c3cb9d4424f0db8d45097b1e985e3d78aa3064736812beba7b1cde1cd1999723
SHA1 hash:	e94ae0b6e0e51d5502a4395b23a519f669998628
MD5 hash:	e2f551deecd687925af773454a3a3bc1
humanhash:	connecticut-lake-neptune-hawaii
File name:	SHIPPING ADVICE.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	689'479 bytes
First seen:	2023-12-15 10:01:12 UTC
Last seen:	2023-12-15 10:50:58 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:erOk+lWjnxl0lse5NC/+EU++vSfJMnTZ4RjxzOUlULX6gpNNDN8T:eVcWjnxl0ee5NCGGfJiTZwjZOwEvj8T
TLSH	T1C8E423105ACE6282F8F42237527390BE587F73104D966615FFE9BD614EA932A301BDF4
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla Shipping zip

cocaman

Malicious email (T1566.001)
From: "M-GLOBAL LOGISTICS <pd01@goldenstar.net>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.107]) "
Date: "15 Dec 2023 04:51:55 +0100"
Subject: "Port Agency Appointment for M/V SANTA IRIS "
Attachment: "SHIPPING ADVICE.zip"

Intelligence

---

File Origin

# of uploads :

5

# of downloads :

161

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	SHIPPING ADVICE.exe
File size:	849'408 bytes
SHA256 hash:	864fe98f784db801dd8514226f5b70bb21f41ef4ffcef3fc77636fbfa039444a
MD5 hash:	b2d9972df6a83648f2ff0a05d8197639
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs2876.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Win32.PWSX-gen.32708.16073.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Rogue.0hr.20231214-1433.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/657c241bd48681e0d661c228/reports/80cbb8ea-e913-466d-ba41-5cffe01a9cc7/overview

Hybrid Analysis Troj/MSIL

Verdict:

Malicious

Labled as:

Troj/MSIL

Link:

https://www.hybrid-analysis.com/sample/f1b5b9880b50454748e9034fa6942f85daed1d7fbf4bf6cf8bbeef514c7b34d3

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/f1b5b9880b50454748e9034fa6942f85daed1d7fbf4bf6cf8bbeef514c7b34d3

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/f1b5b9880b50454748e9034fa6942f85daed1d7fbf4bf6cf8bbeef514c7b34d3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f1b5b9880b50454748e9034fa6942f85daed1d7fbf4bf6cf8bbeef514c7b34d3/

ReversingLabs TitaniumCloud Win32.Spyware.Negasteal

Threat name:

Win32.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-14 17:24:05 UTC

File Type:

Binary (Archive)

Extracted files:

18

AV detection:

19 of 37 (51.35%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6g23tcalkbcuoshjanh2nfbpqxno2hl7x5f7nt4lx3xvctd3gtjq._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231215-snfnbsdfcr/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f1b5b9880b50454748e9034fa6942f85daed1d7fbf4bf6cf8bbeef514c7b34d3