MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb464a51d514a4f48eafc3b9894b85c5567d6d45f817542c147c61af553503f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb464a51d514a4f48eafc3b9894b85c5567d6d45f817542c147c61af553503f8
SHA3-384 hash: a44402744699c1d6b5d12e08192c0efc2f869987a277f063f95d5153250fcd7d10ecb6e4a80d4a95552f3276e1cf40a6
SHA1 hash: 9c98729ea389f010a1b11dbaf323ee0ebc565282
MD5 hash: 7e504941fe377af17039f453a0b4a912
humanhash: april-tango-mountain-eleven
File name:Payment_Advise_pdf.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:615'035 bytes
First seen:2020-10-06 05:47:05 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:Vsvg1Jj5rD9rthMH8G6Ngd937AR4z9pyi3qomIO4Fun:yQJ9n9ZhU8G6N8a+py0qomIcn
TLSH 33D433CA0295C8DD5836C82EF1617CA78C7A58DC27468EF6580CBAE1D88F7057E5E24E
Reporter abuse_ch
Tags:AgentTesla cab HSBC


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: awef0.310.cicmo.ml
Sending IP: 157.245.40.133
From: HSBC Advising Service <advising.service.73456874.890432.3046124410@hsbcnet.com>
Subject: Payment Advice - Advice Ref:[GLV902083666] / Priority payment / Customer Ref:[TT-34020920E-2]
Attachment: Payment_Advise_pdf.cab (contains "Payment_Advise_pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb464a51d514a4f48eafc3b9894b85c5567d6d45f817542c147c61af553503f8/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 23:50:51 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zndeuuovcsspjdvpyo4yss4fyvlh23kf7alvilauprq26vjvap4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb464a51d514a4f48eafc3b9894b85c5567d6d45f817542c147c61af553503f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab cb464a51d514a4f48eafc3b9894b85c5567d6d45f817542c147c61af553503f8

(this sample)

AgentTesla

Executable exe bd5b53d0e2a607818e9d9438452f988d1d0b6c76674ae4d8143b38a4c0cf7abf

  
Dropping
MD5 90e734fe277b2f141b50278105bf663a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd5b53d0e2a607818e9d9438452f988d1d0b6c76674ae4d8143b38a4c0cf7abf

Comments