MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbfe82729be1554a04027fc5a3a0dc09376c893d8b00cf8eee3c66c9b1b0dd22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbfe82729be1554a04027fc5a3a0dc09376c893d8b00cf8eee3c66c9b1b0dd22
SHA3-384 hash: 66004bfe9a881ebae14351e62e38e6395f6318d87d1a21528eea3d2d835f5e3c26943672c9866cfc4e3ee6f522424eef
SHA1 hash: 62fd3462851ad701d7cde5a813dd283ce01b3bb5
MD5 hash: 0cd9f83259ab254c9b129a0acbe7fb99
humanhash: nuts-jig-charlie-march
File name:Quote FOB Price For Attach.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:868'796 bytes
First seen:2021-01-18 08:34:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:TqYcmbBglVE564NCFHp4T5UKh7xzSNSNyUq0io:TbbBglURCFHp4TmMwT0io
TLSH BB0533F657C134D8CD338AD04E24262B6DBFD881E9CDAE57FCD06A064D82B15A693D83
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp2.hiworks.co.kr
Sending IP: 121.254.168.210
From: 임승범(영업) <salem2@sunmyung.com>
Reply-To: "임승범(영업)" <salem2@sunmyung.com>
Subject: a new inquiry
Attachment: Quote FOB Price For Attach.rar (contains "Quote FOB Price For Attach.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbfe82729be1554a04027fc5a3a0dc09376c893d8b00cf8eee3c66c9b1b0dd22/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zp7ie4u34fkuubacp7c2hig4be3wzcj5rmam7dxohrtmtmnq3ura._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cbfe82729be1554a04027fc5a3a0dc09376c893d8b00cf8eee3c66c9b1b0dd22

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cbfe82729be1554a04027fc5a3a0dc09376c893d8b00cf8eee3c66c9b1b0dd22

(this sample)

AgentTesla

Executable exe 0aa319b22736e50f9486096af97cf5d70a4b072116d52c2872708295732862a5

  
Dropping
MD5 39fb50145f41597129835d91952df737
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0aa319b22736e50f9486096af97cf5d70a4b072116d52c2872708295732862a5

Comments