MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cba52a25568677ed2a232dfe9f6561bb0f886329b28240eab5d253558ab5cba6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cba52a25568677ed2a232dfe9f6561bb0f886329b28240eab5d253558ab5cba6
SHA3-384 hash: 7e79b7d92db3c20f660e961786c48088c7d2568615be71cd81633d57420712faa730363dd38101cdcb506797c3fc47f4
SHA1 hash: 40bd1c783060c09fe6866ad8851dc1d9d887921e
MD5 hash: 8f9097f0e3cfef0b62df1aeb712a6889
humanhash: comet-wyoming-grey-diet
File name:bank notice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:428'387 bytes
First seen:2022-04-29 10:40:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:DGDulkbUhy0R3B3ZIfVOTHBK+eiObmmVLSNRZFzA3vdpr:DSu6Gy0+wBNeiOam1SXA3vnr
TLSH T1ED94235B386C3F51FBB85B04C5A9810B9A37F38E552825C7E2EC08E80513D2FAA97D75
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Oben iyang <harris@terry.com>" (likely spoofed)
Received: "from terry.com (unknown [103.149.12.236]) "
Date: "25 Apr 2022 10:53:20 -0700"
Subject: "Wire Transfer Arrangement not through//OCT_SOA."
Attachment: "bank notice.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.15766.15991.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/626bc0c162b1ae4451bd0318/reports/782672ef-f374-4fd1-ad4f-b030f928afda/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/cba52a25568677ed2a232dfe9f6561bb0f886329b28240eab5d253558ab5cba6
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cba52a25568677ed2a232dfe9f6561bb0f886329b28240eab5d253558ab5cba6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-25 18:45:28 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
25 of 42 (59.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zossujkwqz362krdfx7j6zlbxmhyqyzjwkbeb2vv2jjvlcvvzota._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220429-mq39hseehm/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/cba52a25568677ed2a232dfe9f6561bb0f886329b28240eab5d253558ab5cba6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip cba52a25568677ed2a232dfe9f6561bb0f886329b28240eab5d253558ab5cba6

(this sample)

AgentTesla

Executable exe 6dec2de4134fbbd9b62af9bfcfd0e6500875328196ef945d805f2480d0521a98

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6dec2de4134fbbd9b62af9bfcfd0e6500875328196ef945d805f2480d0521a98
  
Dropping
AgentTesla

Comments