MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb912112d4b69add324d87fb281cd089239ffb5d49efe6bd2403e8c3f3a0278e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb912112d4b69add324d87fb281cd089239ffb5d49efe6bd2403e8c3f3a0278e
SHA3-384 hash: 51c02638902b49c52a0fdacefd5c028f1523724fb7dab75d41dba7549a47e3497153ef0ebce6e9f79611a81d510e5513
SHA1 hash: a0411d98cd6881e112d82ce291add345275fb363
MD5 hash: 86f61b89a9bfeb883011d1e992fc4fd8
humanhash: four-jupiter-uniform-winner
File name:Remittance.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:363'091 bytes
First seen:2020-09-23 03:59:37 UTC
Last seen:2020-09-23 04:05:19 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:ghnYbPybG2EE7XLmdzGbvTGbd8IQS7weqn5UKklaRpnZnxlYP7muSaiLFKT+:gZYebG2EE70GbrmSIQiYnvvrnxlYjmuC
TLSH C674235A5C6EC4C14863CF66279697D833A411757E80BB269E28CFF4B683B30467DB34
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "nurun.nabi@deengroupbd.com"
Received: "from deengroupbd.com (unknown [209.58.149.87]) "
Date: "23 Sep 2020 00:33:09 -0700"
Subject: "RE, REQUEST FOR AUGUST SOA TO PROCEED PAYMENT."
Attachment: "pymt,soa.rar"

Intelligence

File Origin
# of uploads :
4
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb912112d4b69add324d87fb281cd089239ffb5d49efe6bd2403e8c3f3a0278e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-22 22:03:50 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zoiscewuw2nn2msnq75sqhgqrerz7625jhx6npjeapumh45ae6ha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb912112d4b69add324d87fb281cd089239ffb5d49efe6bd2403e8c3f3a0278e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cb912112d4b69add324d87fb281cd089239ffb5d49efe6bd2403e8c3f3a0278e

(this sample)

AgentTesla

Executable exe cd2b2d05e9154852f77c8377ee83f620951e47047bb702e026690508fee44416

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cd2b2d05e9154852f77c8377ee83f620951e47047bb702e026690508fee44416

Comments