MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1a34e54838bd4989255be0672ed728a1d4e7eaddbcb8b2027411c1c0983e253. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1a34e54838bd4989255be0672ed728a1d4e7eaddbcb8b2027411c1c0983e253
SHA3-384 hash: 40ef30755afafd5cf80870c3367f22890a36a6e7cb5aa3c1eed43dd98fe1907cd96b521dbb4394be6be96648e080b5f3
SHA1 hash: 76fd60d5ea583f251d94ad511f26cf1b0c0fc1db
MD5 hash: b3918135f0fb11677ea317c613a80bbd
humanhash: helium-blue-eight-high
File name:Q88_Bulk Carrier.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'643 bytes
First seen:2021-04-08 07:04:30 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:CP1chQqNSsbrRHuIi3k2VQJ2Bc1J+msgKK0SKuOSlJTGstRNkf:IuHJfpuIizQJtL7sdK0SKunTvLNi
TLSH F9A423579855B390AA5391821C8B1E0B115F47F29FC2BBF8515A8348327F907B6BEF31
Reporter abuse_ch
Tags:cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hp0.309.orxo.cf
Sending IP: 138.197.150.41
From: "Ops" <f_fujiwara@gmsline.co.jp>
Subject: Proforma d/a & Port information for discharge Pool Iron
Attachment: Q88_Bulk Carrier.cab (contains "Q88_Bulk Carrier.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.10350.22782.4073.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1a34e54838bd4989255be0672ed728a1d4e7eaddbcb8b2027411c1c0983e253/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 04:20:03 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugru4vedrpkjresvxydhf3lsriou47vn3pfywibhieobycmd4jjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1a34e54838bd4989255be0672ed728a1d4e7eaddbcb8b2027411c1c0983e253

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab a1a34e54838bd4989255be0672ed728a1d4e7eaddbcb8b2027411c1c0983e253

(this sample)

AgentTesla

Executable exe 3f0fa5c8ebb2640afc948bfd5c8bb0ba644222b3bc15c095085d718843d59915

  
Dropping
MD5 2fe4b829f1cfa6c3183a1e0391309eb0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f0fa5c8ebb2640afc948bfd5c8bb0ba644222b3bc15c095085d718843d59915

Comments