MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd90879d7f7ddf4e21052860c76cda9221382b1c9cd22e28b2dd37ec67e7e437. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	cd90879d7f7ddf4e21052860c76cda9221382b1c9cd22e28b2dd37ec67e7e437
SHA3-384 hash:	e8d4d99268ee5cdcbfdf0d2715ee32d1b5ae83b8623a9aac426a995988880bd7baae10f7e3a4599d48ee13a43969bc0e
SHA1 hash:	1073a1bd46f6cf22e71f35fbc672d22fa313fb22
MD5 hash:	1d783185b804f8789a59b491be6ca132
humanhash:	steak-mobile-iowa-uniform
File name:	1073a1bd46f6cf22e71f35fbc672d22fa313fb22
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	223'916 bytes
First seen:	2023-07-08 08:47:56 UTC
Last seen:	Never
File type:	unknown
MIME type:	text/plain
ssdeep	3072:56a2DfoGHI31zW+md9Aj1eD1Jj4gVfbt9+WoshxWC7aOw35AnL2yVfzir:XftW+7EDLjFZSWos3WRO2AnL1Vfzir
TLSH	T1E5244B71824BEF862D230E5AF659265BDC4D64EFB65084FCAAC286D051F1A08CF9CCF5
Reporter	JAMESWT_WT
Tags:	79-110-49-55

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.67761713.2050.19993.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/64a922c9dbb9e835463f02dd/reports/b2701db4-b51a-424d-a303-99fe37eada39/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/cd90879d7f7ddf4e21052860c76cda9221382b1c9cd22e28b2dd37ec67e7e437

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd90879d7f7ddf4e21052860c76cda9221382b1c9cd22e28b2dd37ec67e7e437/

Threat name:

Script-WScript.Trojan.Heuristic

Status:

Malicious

First seen:

2023-06-14 21:44:55 UTC

File Type:

Text

AV detection:

8 of 38 (21.05%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zwiiphl7pxpu4iiffbqmo3g2siqtqky4ttjc4kfs3u36yz7h4q3q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cd90879d7f7ddf4e21052860c76cda9221382b1c9cd22e28b2dd37ec67e7e437

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	SUSP_Reversed_Base64_Encoded_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an base64 encoded executable with reversed characters
Reference:	Internal Research

Rule name:	SUSP_Reversed_Base64_Encoded_EXE_RID3291 Create hunting rule
Author:	Florian Roth
Description:	Detects an base64 encoded executable with reversed characters
Reference:	Internal Research