MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2b1dde3de32cd13f3262bce27f82b3a80ff7d55b5670d70f3d7938d960e0573. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2b1dde3de32cd13f3262bce27f82b3a80ff7d55b5670d70f3d7938d960e0573
SHA3-384 hash: f6fb5338b76d67196b6a29e4f27ae6be4815adc991dd29ad5e33b124e50e1966194166612b5ccf59b15d6919b74a16cc
SHA1 hash: 597d35d80f9ad0db12f76c531ef2e26a1d7f782a
MD5 hash: dbd3e9ecc188a7265de62ff6352dbbd7
humanhash: magazine-zebra-wisconsin-steak
File name:URGENT New Order.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'334'835 bytes
First seen:2020-05-08 04:25:17 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:UlJk6QqXLCZ/yI38tapaNjCVnhlYZ1QHRkn6gj/SV/pbNLR40:kJk6177ta4tCVhlzRk6s/c1RR40
TLSH 26553301DFA27339E8518EE1482F7A0748B813D6CD2E68D2B5EED44C6810B47ABD57BD
Reporter cocaman
Tags:AgentTesla cab


Avatar
cocaman
Malicious email
From: Mohits J H<manager.parts@eurotec.com>
Received: from eurotec.com (unknown [45.137.22.40])
Date: 7 May 2020 16:14:55 -0700
Subject: URGENT New Order
Attachment: URGENT New Order.cab

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 04:45:24 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yky53y66glgrh4zgfphcp6blhkap67kvwvtq24ht26jy3fqoavzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab c2b1dde3de32cd13f3262bce27f82b3a80ff7d55b5670d70f3d7938d960e0573

(this sample)

AgentTesla

Executable exe 2e7f95b47bc6f8c733ecdb9895e810a8378d9a908bde0f990f1631aa86e68cc3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e7f95b47bc6f8c733ecdb9895e810a8378d9a908bde0f990f1631aa86e68cc3

Comments