MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbc2cfb79f2198d06f4af44dae729619a5681dccedfea0f2053e9d4439959af8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbc2cfb79f2198d06f4af44dae729619a5681dccedfea0f2053e9d4439959af8
SHA3-384 hash: 9e4a1308d5bc54201e5bc58647bfbd8614ea2f24ddc0fa0cf7d0ad76a02ab6194cb1c1238a36cabd2283530d786f2b1e
SHA1 hash: 0dd55d84a84a3c10b66e57d6c556a0b36fd946e7
MD5 hash: ab7ea679ca9abfae0dcb4e9afa5892ad
humanhash: may-south-high-connecticut
File name:0111.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:780'874 bytes
First seen:2020-08-04 13:28:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BfVDYEOL1EflKW86ksmdhhekF6JGNi1eaKWOlUFca9zCiya42wGa:51IEflKW86ks8764NiTKvlLawivT5a
TLSH 1BF433B4CD45C9E8F50A67A4C7BB84500DE5CE042F26B2869CC65B9439FBD8B0F5EB81
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ivgspa.it
Sending IP: 103.99.1.226
From: Janice Liu <Liu.Xinyue@ivgspa.it>
Subject: Re: copy of PO. no. 132
Attachment: 0111.zip (contains "0111.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis61867D2DD1B4.10017.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbc2cfb79f2198d06f4af44dae729619a5681dccedfea0f2053e9d4439959af8/
Threat name:
ByteCode-MSIL.Spyware.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:30:08 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zpbm7n47egmna32k6rg244uwdgswqhom5x7kb4qfh2ouiomvtl4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/cbc2cfb79f2198d06f4af44dae729619a5681dccedfea0f2053e9d4439959af8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip cbc2cfb79f2198d06f4af44dae729619a5681dccedfea0f2053e9d4439959af8

(this sample)

AgentTesla

Executable exe 3a18512fa6205d515cde261cc9b79dc09c6dcd733c4f07b79d8713e282b1ea6f

  
Dropping
MD5 61867d2dd1b43ebbd5bf1c06af72d855
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a18512fa6205d515cde261cc9b79dc09c6dcd733c4f07b79d8713e282b1ea6f

Comments