MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbfeb7245db426440564cc9de2987213b2832fc13876d58864ea9d9774162f60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbfeb7245db426440564cc9de2987213b2832fc13876d58864ea9d9774162f60
SHA3-384 hash: 2755a14d3349456bf040c089e87069b5bb53e6a0ce526d0f00245dfbff5d3f7c922a48236435c9fc578b7fb2ba74658f
SHA1 hash: 0ffbcd8bf5c27fcb164f2f5edf9d241e58f777e4
MD5 hash: de177d411f2bcf0949cfba89181919a9
humanhash: crazy-comet-social-oven
File name:Customer Order, Images, Spec.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'686 bytes
First seen:2020-12-16 07:55:47 UTC
Last seen:2020-12-16 10:06:21 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:pX8vLjLvAvy0q4cN4E3wHOWR+W63OBjuNl+64vFBSXMN3KNA:psvnLtN944SzRJeOBm+ZvjSXEoA
TLSH 7E54230FED50B3EF2A802EC2D762C336F4534F94AB1AE95699752B33147F8509B92815
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Gupta <kfo@jydepejsen.dk>" (likely spoofed)
Received: "from jydepejsen.dk (unknown [23.106.223.74]) "
Date: "15 Dec 2020 23:29:54 -0800"
Subject: "Price Request"
Attachment: "Customer Order, Images, Spec.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.20267.19377.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbfeb7245db426440564cc9de2987213b2832fc13876d58864ea9d9774162f60/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-16 07:53:42 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zp7lojc5wqteiblezso6fgdscozigl6bhb3nlcde5kozo5awf5qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cbfeb7245db426440564cc9de2987213b2832fc13876d58864ea9d9774162f60

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip cbfeb7245db426440564cc9de2987213b2832fc13876d58864ea9d9774162f60

(this sample)

AgentTesla

Executable exe c22dac65ca71dda0a712ea5bf6c959c2dcd620bc47172dc59cf1fb28a28dcbc2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c22dac65ca71dda0a712ea5bf6c959c2dcd620bc47172dc59cf1fb28a28dcbc2

Comments