MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06e01de761ad523848a04f47fd6181781678359546228bcde009da1b5f786c77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06e01de761ad523848a04f47fd6181781678359546228bcde009da1b5f786c77
SHA3-384 hash: 73a2657843f924c9b759789da6c56754a9fd55ce450180f8a7f25d416d64551ddf2da9bada906cae40d4c9ebbae8d076
SHA1 hash: 78b9704bbf5c3d306f936a5bca464773333276b0
MD5 hash: 82e9507790a0ef31ef788045017e010c
humanhash: robert-maryland-vermont-berlin
File name:DHL notification.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:933'709 bytes
First seen:2020-06-16 06:12:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Z/ZSVZL88vjm7TsGHORYTZIgAEeGa15zXkl21tqvwdqi8VzGmbufayTiHJE76:Z/ZSf8yjSbHYgAEK1xPDq4dIzGmb3bq2
TLSH 811533FBBC899BE57E716EA2A029542DC18C73E2E4D3232F84666107A5332641C1DCDE
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: klemsan.pw
Sending IP: 23.254.211.57
From: hr@klemsan.pw
Subject: Notification for shipment event group “Delivery Exception” for victim-email
Attachment: DHL notification.rar (contains "DHL notification.exe")

AgentTesla SMTP exfil server:
mail.mexicanproduct.com.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 06:14:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a3qb3z3bvvjdqsfaj5d72ymbpalhqnmviyrixtpabhnbwx3ynr3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 06e01de761ad523848a04f47fd6181781678359546228bcde009da1b5f786c77

(this sample)

AgentTesla

Executable exe 143f0e119d4dd0c3e2361731af03d2f59eafc9f6b84af7e90c19b8efd8cbbe4e

  
Dropping
MD5 e5a38808d52f72c83986cfbe117615d3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 143f0e119d4dd0c3e2361731af03d2f59eafc9f6b84af7e90c19b8efd8cbbe4e

Comments