MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbde372f4f557c7d142463c9bf4da8e22057d7c17b2313a62b91f0e1d887382f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbde372f4f557c7d142463c9bf4da8e22057d7c17b2313a62b91f0e1d887382f
SHA3-384 hash: ccca33e2f402417f9f8cbfbaa15a9b05b04803cd0faa8062b336168e99d99b57524781aceaaaac8a7b4f1f1880f43fe5
SHA1 hash: f383213f0eb4c794a4cb75a5e4e9f04dd2be54c6
MD5 hash: 21b2e1aba0d348d1894265485da08886
humanhash: black-carpet-mirror-twenty
File name:PO290720.ARJ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:407'334 bytes
First seen:2020-08-05 07:51:24 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:QOMQriopKhH3KuVGrHbLk6UlOY3zpJhetcOSOTxhgatpST5pBErQaA44:QO16dvVGrH/k6UlOE+Kwa88BAQaAN
TLSH 4D842385EDE436759084179EF0E321FA43F9E531A1DB32684D9026EE740E8DCA6E5CF2
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: serve0.hshgroups.co
Sending IP: 104.168.166.26
From: Ali Hamood Al-Marhubi <info@hshgroups.co>
Subject: Confirm order PO#290720
Attachment: PO290720.ARJ (contains "k0MM28dQ1qg4ilE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbde372f4f557c7d142463c9bf4da8e22057d7c17b2313a62b91f0e1d887382f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:53:05 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zppdol2pkv6h2fbempe36tni4iqfpv6bpmrrhjrlshyodwehhaxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cbde372f4f557c7d142463c9bf4da8e22057d7c17b2313a62b91f0e1d887382f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj cbde372f4f557c7d142463c9bf4da8e22057d7c17b2313a62b91f0e1d887382f

(this sample)

AgentTesla

Executable exe 3f1fead406e75287bf07b6bb2147a8be5b1769b5dd8bf7ef49f5450fae849da0

  
Dropping
MD5 85e59f9379754d73cdc8114979993f64
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f1fead406e75287bf07b6bb2147a8be5b1769b5dd8bf7ef49f5450fae849da0

Comments