MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28bd00e9460e69da0276d5526c2a0bcca8dce1eee2b540b8673059076506b9d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28bd00e9460e69da0276d5526c2a0bcca8dce1eee2b540b8673059076506b9d7
SHA3-384 hash: 0ac92e7ad26aad24fa50dd9d332be047646fbb1fd1d61cb4d0b8fb188ea8d1f2fcb9331262f9d49f6bc2fceab686fcfb
SHA1 hash: 36de644eb343b85c36f049ec9b6cf62106515136
MD5 hash: 5c697b555c3ec5687dcd59f6c7f60499
humanhash: may-king-steak-alpha
File name:Arrival Notification documents and receipt.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:839'680 bytes
First seen:2020-07-24 10:15:11 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:06gVShDE44QqzJ+K0IfStTwe0FW3rE40nZuvBdHI6WTJ1JK6ipY9ID382FI1Jtpu:28m4k7f5e0arEZiITJu6tGs+ODpkGK
TLSH 35055A3A7B419415C53C1A7284E96981B6B1A6473B11C70F39DB13ACAF033DF7B8626E
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.alvindoprt.ml
Sending IP: 198.148.118.241
From: DHL Express <info@alvindoprt.ml>
Subject: DHL Arrival Notification : documents and receipt
Attachment: Arrival Notification documents and receipt.iso (contains "Arrival Notification documents and receipt.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28bd00e9460e69da0276d5526c2a0bcca8dce1eee2b540b8673059076506b9d7/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 03:20:52 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fc6qb2kgbzu5uatw2vjgykqlzsunzypo4k2ubodhgbmqozigxhlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/28bd00e9460e69da0276d5526c2a0bcca8dce1eee2b540b8673059076506b9d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 28bd00e9460e69da0276d5526c2a0bcca8dce1eee2b540b8673059076506b9d7

(this sample)

AgentTesla

Executable exe 229b77e177c83589c3ff1a34d1f1f3830bb769be4ec40fee0ecd3e937850da0a

  
Dropping
MD5 9964a25605beaf8624fd61e229cadac6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 229b77e177c83589c3ff1a34d1f1f3830bb769be4ec40fee0ecd3e937850da0a

Comments