MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b5bd985230c3387f1330f9ec74304aee1cf0cb89ff7d1a1d31584b33faa6ce2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b5bd985230c3387f1330f9ec74304aee1cf0cb89ff7d1a1d31584b33faa6ce2
SHA3-384 hash: a77e2fb1cee48145120d3a79e4077802ab7bbfca845aeea6563ba2e0451b005f9219ab1d8d773b0cf1f6c1d28b0a8fd3
SHA1 hash: bd2c32ff723583478a6fc7f788014105b58fe616
MD5 hash: b7e072202fa7343775c888cbc817f5d6
humanhash: quiet-louisiana-mango-vegan
File name:DHL001173982902PDF.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:731'136 bytes
First seen:2020-06-02 10:21:20 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:6aUDdS6VEt6FCo59B5YkHqblS8+lXOoUec:Us6NFBf5YkHqblS8+lXOo1c
TLSH BDF42B3E76C5A405E53C057300DB66D1BAB6A5433A12C30F79DF576CAF02BCA2B1636A
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: britishcollegelacanyada.servidoresdedicados.com
Sending IP: 84.246.210.107
From: DHL EXPRESS LIEFERUNG <NOREPLY@dhl.com>
Reply-To: agrotranscomex@lorinfo.ro
Subject: DB_DHL_AWB_00117390021 / AD
Attachment: DHL001173982902PDF.iso (contains "DHL001173982902PDF.exe")

AgentTesla FTP exfil server:
ftp.solarcenter.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 03:12:00 UTC
AV detection:
9 of 31 (29.03%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnn5tbjdbqzyp4jtb6pmoqyev3q46dfyt735diotcwclgp5kntra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 2b5bd985230c3387f1330f9ec74304aee1cf0cb89ff7d1a1d31584b33faa6ce2

(this sample)

AgentTesla

Executable exe c48693c5940a8dd8ec1ed3ad688b53c84f532488565c13b477e9406178f01c44

  
Dropping
MD5 add5a01599bd60dc2984c77c67d72edc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c48693c5940a8dd8ec1ed3ad688b53c84f532488565c13b477e9406178f01c44

Comments