MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 480cd3bc03f14a0132e05718fff0926fbe44cec403be8d8072bed388be29de49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 480cd3bc03f14a0132e05718fff0926fbe44cec403be8d8072bed388be29de49
SHA3-384 hash: 4e23f16ace239d1582f987b9795be7e476e8ebc045957679dba9c0ae5b9fa075e095e515621e081b104ef30d68066cdd
SHA1 hash: 22d240e8dc3a42419f1e8e600cc788b68758e59b
MD5 hash: bbc9f92c2b3c6dfbb3a5764facde3251
humanhash: montana-kansas-equal-nebraska
File name:SWIFT.pdf.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:520'782 bytes
First seen:2020-10-19 06:27:40 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:WTSY2f1MjZhB1qVzZrRSQf7lpnQgQhHxuVzzDTfptE3ZvdJ:WTS7G9z1GrRSwnQ+VvDTfpt0dr
TLSH 51B423DB568434718367BF7DD660CA4E29E42A1D1830E4EA3791B8E8FE054E5E31FC4A
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cwp.zelenilo.com
Sending IP: 213.240.61.171
From: Milorad Krivokapic <dekany.minor.sk@gmail.com>
Subject: Fw: SWIFT poruka-potvrda izvrsenog placanja
Attachment: SWIFT.pdf.cab (contains "SWIFT.pdf.exe")

AgentTesla SMTP exfil server:
delovnaposta.telekom.mk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/480cd3bc03f14a0132e05718fff0926fbe44cec403be8d8072bed388be29de49/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 00:12:58 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jagnhpad6ffacmxak4mp74esn67ejtweao7i3adsx3jyrprj3zeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/480cd3bc03f14a0132e05718fff0926fbe44cec403be8d8072bed388be29de49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 480cd3bc03f14a0132e05718fff0926fbe44cec403be8d8072bed388be29de49

(this sample)

AgentTesla

Executable exe 2a24ffa6d726a44c5622fde2eac0f0e770063abf5bcca8f9b33c097677aed2a9

  
Dropping
MD5 fe7d393a843474ab7c04a323a9b91e70
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2a24ffa6d726a44c5622fde2eac0f0e770063abf5bcca8f9b33c097677aed2a9

Comments