MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb78ab68c999ed4a518f7dfa7ead04f75dabafe52c7f94fa428c56be57c954a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb78ab68c999ed4a518f7dfa7ead04f75dabafe52c7f94fa428c56be57c954a5
SHA3-384 hash: ad125c5ddd789061c6961a5a6cc44bcc68de0b9931e060c28b2cd48c9ad905e4b87b57b570bff4769d1cc3d86815d410
SHA1 hash: fa083b223ea07d99d418bda0d6c42769099b66a8
MD5 hash: 55de79c73a4d1221efdbdae2a01f78d6
humanhash: may-lima-maine-floor
File name:MV Huanghai Pioneer TK-812B.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:883'667 bytes
First seen:2021-02-02 06:24:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:WKldllc8mh9+zxNDTWHgvBc7Q/SC6/ey6kUyJlkDXD+:WK3Hu7OxNDTWHOH/56/ewx0D+
TLSH C11533E023E530DD4EDB60E5AAA0646B15AEFC33842759A44C5FA95077218A0CFBB773
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Jua Park"<operation@mabong.co.kr>" (likely spoofed)
Received: "from vm1829147.nvme.had.yt (vm1829147.nvme.had.yt [77.220.213.13]) "
Date: "Mon, 1 Feb 2021 14:34:46 +0100"
Subject: "VSL: MV Huanghai Pioneer, ORDER: TK-812B"
Attachment: "MV Huanghai Pioneer TK-812B.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb78ab68c999ed4a518f7dfa7ead04f75dabafe52c7f94fa428c56be57c954a5/
Threat name:
Win32.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 22:32:46 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zn4kw2gjthwuuumppx5h5lie65o2xl7ffr7zj6scrrll4v6jkssq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cb78ab68c999ed4a518f7dfa7ead04f75dabafe52c7f94fa428c56be57c954a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cb78ab68c999ed4a518f7dfa7ead04f75dabafe52c7f94fa428c56be57c954a5

(this sample)

AgentTesla

Executable exe 9885e59ed40fe0dd7227188294b241c1c4d2d488c656c2409648efeeaf560d07

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9885e59ed40fe0dd7227188294b241c1c4d2d488c656c2409648efeeaf560d07
  
Dropping
AgentTesla

Comments