MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b83106aa31d910995cc786349acf993d040a8e30a985a9897b924aebdd9ea6d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b83106aa31d910995cc786349acf993d040a8e30a985a9897b924aebdd9ea6d9
SHA3-384 hash: 135e9ba915b0f23ca0ab178dd7620d1eb02384ed4d194739aa058b13cfcd5ee5d45b44dbee0bf1e2f3bb39bea8592a89
SHA1 hash: ec53606c99d163e9174d54a29aa77609a8802e77
MD5 hash: 3b201ffe3bd4815478b82993c99492a0
humanhash: fillet-table-romeo-lactose
File name:MT SC GUANGZHOU.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:579'590 bytes
First seen:2021-02-24 07:02:38 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:rd1PhfPrYBr0avre7+VpHd2rvMwW+0nSmOpN9zmprTQlGVRcybOMJYEBtIedZkz1:Z1PZj6nvrW+Vov9wSmOpN9zQ0mvYEBtg
TLSH 96C423F34A68AF91DB0FA32C715D806ADFCFDDA8D8FBB870605533E1495E680A06C951
Reporter abuse_ch
Tags:cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: df0.330.xvonq.ml
Sending IP: 165.22.36.140
From: "JUNZHENGSHIPPING" <shpng@junzhenggroup.com>
Subject: MT SC GUANGZHOU V.2019 Agent NOMINATION FOR Discharging
Attachment: MT SC GUANGZHOU.cab (contains "MT SC GUANGZHOU.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.24593.11685.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b83106aa31d910995cc786349acf993d040a8e30a985a9897b924aebdd9ea6d9/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 02:00:19 UTC
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xayqnkrr3eijsxghqy2jvt4zhucavdrqvgc2tcl3sjfoxxm6u3mq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab b83106aa31d910995cc786349acf993d040a8e30a985a9897b924aebdd9ea6d9

(this sample)

AgentTesla

Executable exe cc424dade519d54fb637e0ab4526dff7fdfa37919f921d69f85b5f1b5209abb4

  
Dropping
MD5 222bd8c6f12fa627830e24707944fb33
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc424dade519d54fb637e0ab4526dff7fdfa37919f921d69f85b5f1b5209abb4

Comments