MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd4b26d62cde6136822be4ef474978995a21a034895a8888479775d14e2126fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd4b26d62cde6136822be4ef474978995a21a034895a8888479775d14e2126fa
SHA3-384 hash: 1e5940a47174587c39054f3144e9819527c14c47fdf6b5b39c9218a724abedbd16dd6a548b6eb80a981faeccb3f22a0c
SHA1 hash: 60672490ad785491bef608f410235db59cb87324
MD5 hash: 053ae14a68f83dbf0e6b0033b09095a5
humanhash: oklahoma-fourteen-eighteen-sink
File name:INVOICE.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:381'866 bytes
First seen:2021-01-19 07:35:48 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:d21/+LqSHFtuQFBxuIH6QrQPcmJBUbuChnMH6v8eJvuEgZnR2tt5vg5hyA3xYd:d2x+LqKFtl2UQPcmBgu+nMHU8eJvJYn4
TLSH E68423FD948B2AD2F086137FCDB845178945C56C987A982944E13E901FB58FACCCEF98
Reporter abuse_ch
Tags:cab DHL


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.hostmaden.com
Sending IP: 77.92.141.108
From: DHL Express <noreply@dhl.com>
Subject: ORDER REQUEST
Attachment: INVOICE.cab (contains "INVOICE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Bang5mai-6804572-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd4b26d62cde6136822be4ef474978995a21a034895a8888479775d14e2126fa/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:36:12 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xvfsnvrm3zqtnarl4txuoslytfncdiburfnircchs525ctrbe35a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bd4b26d62cde6136822be4ef474978995a21a034895a8888479775d14e2126fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab bd4b26d62cde6136822be4ef474978995a21a034895a8888479775d14e2126fa

(this sample)

AgentTesla

Executable exe 94e4d23e3ede10365bdc9ebcf52fab0428c693b3c8d768d4090139d9607d3f95

  
Dropping
MD5 bedc66c12a9045e1d8e89fd47ccd4ebb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94e4d23e3ede10365bdc9ebcf52fab0428c693b3c8d768d4090139d9607d3f95

Comments