MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f28bb816fd8e5dd101f1815d96f19f4f87a8bec5601c07f5dedd66ade17b6d3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f28bb816fd8e5dd101f1815d96f19f4f87a8bec5601c07f5dedd66ade17b6d3b
SHA3-384 hash:	bcb675813c051d773f905db481305543130e102d8f50a4fe1299a5ff957ec5a32737699f80d5179b827b6e2f76655079
SHA1 hash:	b4653b4e6c55378775ca02a3e8a7e68f196c15f3
MD5 hash:	a6c5bc3b149a0cf33b3399e5dc957b52
humanhash:	cola-nine-ten-alpha
File name:	payment.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	653'487 bytes
First seen:	2023-12-17 20:06:30 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:fMIA+IkkhWtcmmhrabp1LeYYYTrj4f7ZIVK5VmXL2u+opXYCzd6ykjkynUvQgfID:0QILhIFeabrLeYxrEf7Z1a2ixAjrQ0MW
TLSH	T184D4232464CF6DD95DF4E35B2EA133273A8CD9AA81DC751AF3230B82D0691D393B5388
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	AgentTesla payment zip

cocaman

Malicious email (T1566.001)
From: ""jose.ramirez"<jose.ramirez@expeditors.com>" (likely spoofed)
Received: "from expeditors.com (unknown [91.92.243.208]) "
Date: "17 Dec 2023 06:28:43 -0800"
Subject: "payment slip"
Attachment: "payment.zip"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

202

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	payment.exe
File size:	866'304 bytes
SHA256 hash:	2743ed82252fc5c06c1696d961a2fd9ec7e1a49f085b08f6d88ec554707d9e0c
MD5 hash:	7a3bb6d3030ff7c165543f0c687011dc
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs3369.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Win32.PWSX-gen.3836.18038.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.21347.ZipHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

80%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/657f54e76b1c246046f906e0/reports/073e4c26-1450-4568-8993-8d7827e78a1d/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/f28bb816fd8e5dd101f1815d96f19f4f87a8bec5601c07f5dedd66ade17b6d3b

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/f28bb816fd8e5dd101f1815d96f19f4f87a8bec5601c07f5dedd66ade17b6d3b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f28bb816fd8e5dd101f1815d96f19f4f87a8bec5601c07f5dedd66ade17b6d3b/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-17 10:06:13 UTC

File Type:

Binary (Archive)

Extracted files:

8

AV detection:

19 of 37 (51.35%)

Threat level:

  2/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6kf3qfx5rzo5caprqfozn4m7j6d2rpwfmaoap5o63vtk3yl3nu5q._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f28bb816fd8e5dd101f1815d96f19f4f87a8bec5601c07f5dedd66ade17b6d3b