MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cba1f684829766e90de6c030625e550e0ee4b88575e35a904c5b4bcb1439b9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cba1f684829766e90de6c030625e550e0ee4b88575e35a904c5b4bcb1439b9d
SHA3-384 hash: 08e858a56819a7d6e7041021b93973ce7c9a4d034f79899b2663dbffecded6bff6e7832d9d1a6b461c5154f48c5422b5
SHA1 hash: 7f42d6ad4a1b81cf7401d39d4f69449b0fb50dcd
MD5 hash: 5737c8faa213f70047fb24277633d9e6
humanhash: cola-quiet-hamper-eleven
File name:USD67,884.08_Payment_Advise_9083008849.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:459'892 bytes
First seen:2020-11-21 19:33:36 UTC
Last seen:2020-11-22 09:10:57 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:w7MFr7N7R9uBHlurhUg2Ydz3p47z8bu88XYTBV:j57pwaag2YGHTJXm
TLSH 45A423CCA2D5E1D02C5C990BB436A5066879B79AF43CE04E7F5AD1A1F41339A84F6CBC
Reporter cocaman
Tags:AgentTesla arj HSBC


Avatar
cocaman
Malicious email (T1566.001)
From: ""Annabel Weiss - Financial dept HSBC"<treybd@gmail.com>" (likely spoofed)
Received: "from smtp4 (unknown [52.252.101.133]) "
Date: "Sat, 21 Nov 2020 09:56:25 -0800"
Subject: "Fwd: Payment for outstanding invoices"
Attachment: "USD67,884.08_Payment_Advise_9083008849.arj"

Intelligence

File Origin
# of uploads :
5
# of downloads :
316
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cba1f684829766e90de6c030625e550e0ee4b88575e35a904c5b4bcb1439b9d/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-21 19:34:05 UTC
File Type:
Binary (Archive)
Extracted files:
51
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ts5b62ciff3g5eg6nqbqmjpfkdqo4s4ik5pdlkieyw2lzmkdtooq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9cba1f684829766e90de6c030625e550e0ee4b88575e35a904c5b4bcb1439b9d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9cba1f684829766e90de6c030625e550e0ee4b88575e35a904c5b4bcb1439b9d

(this sample)

AgentTesla

Executable exe 3a89a79e825bf330e3ea46f6a5f548529b642dc61219a8deeaec070a0688a08e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a89a79e825bf330e3ea46f6a5f548529b642dc61219a8deeaec070a0688a08e
  
Dropping
AgentTesla

Comments