MALICIOUS — ALMI HYDRA REQUISITION 0015-SP205005.cab

MALICIOUS — ALMI HYDRA REQUISITION 0015-SP205005.cab is a archive sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Bladabindi family. 4 of 54 detection engines flagged it.

Identification

• SHA-256: 86efd31ccdbf12635028027f852be31481544d157c0f24c338ed941a2dd32719
• SHA-1: e319feac5e9cd03c1a95fdca95ff6615691af7e7
• MD5: 5adcc062f6d2c173a3d7d2fef7d3b4cc
• ssdeep: 6144:5s23+Ihydeww6zI9m51FGBtZgiPIcSADRwIhZQFoEwi+A2BCXQ7:5s2OIIq6s9UiPI2aI3LCg7
• TLSH: T1F945234169E97582A0E8716C548E6C28C5C79ABFC335A08C40DEF3E50C1DAB9134FAF8
• Submitted as: ALMI HYDRA REQUISITION 0015-SP205005.cab
• File type: archive · Size: 284331 bytes
• Verdict: malicious (97/100) · Family: Bladabindi

Detections (4 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Win.Packed.Bladabindi-10017208-0
• Microsoft Defender: Trojan:MSIL/AgentTesla
• Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Packed.Bladabindi-10017208-0 (rule Win.Packed.Bladabindi-10017208-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:MSIL/AgentTesla (rule Trojan:MSIL/AgentTesla) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Agent.gen (rule HEUR:Trojan.MSIL.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Archive contents (1 executable)

This archive carries 1 extracted member, each analyzed as its own sample:

• ALMI HYDRA REQUISITION 0015-SP205005.exe - a3af7372c62b715b45e285c00892c47ccb6ac02e2e525a9d602ecc5b885d55a6

More Bladabindi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report