MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 323f5df4f0e249f6d5c3666d5cc21893672fe3e8b0bb42079b32f603899871c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 323f5df4f0e249f6d5c3666d5cc21893672fe3e8b0bb42079b32f603899871c2
SHA3-384 hash: cc0b6d53dd16dd8b648dcba44fcacfb79502ba0f441feadae2927b6b94e99dac45fe4fe8d1d87fed2c188893cf226296
SHA1 hash: 337115f33be26369f74c90c94946a85988cc222e
MD5 hash: cf3140104c146e7a3fee4fd36d441108
humanhash: arkansas-arizona-august-zebra
File name:DHL_Confirmation_CBJ190517000131QT.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:958'192 bytes
First seen:2020-05-26 11:06:06 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 24576:BhMi+mAftaCA93daGyUBJBUdbBEk6uWI8BiME1+2i2:vM8AVaCA930GyFbB36uWIxMU+2i2
TLSH 2A1523F4AD6EB01B267167AB940CB87BEB166833FCE3FD99620D438350993A7640D174
Reporter abuse_ch
Tags:AgentTesla arj DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: anchorai.pw
Sending IP: 173.82.243.236
From: DHL <info@anchorai.pw>
Subject: Confirmation CBJ190517000131
Attachment: DHL_Confirmation_CBJ190517000131QT.arj (contains "DHL_Confirmation_CBJ190517000131QT.exe")

AgentTesla SMTP exfil server:
smtp.homecares-tw.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:36:53 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 323f5df4f0e249f6d5c3666d5cc21893672fe3e8b0bb42079b32f603899871c2

(this sample)

AgentTesla

Executable exe 84576eb81afad9ffdc32144ed3ebf5ebb7e63b27b18725a0e7cead356d3bed60

  
Dropping
MD5 aad5b1e199c32ea8f365c742f72112f5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84576eb81afad9ffdc32144ed3ebf5ebb7e63b27b18725a0e7cead356d3bed60

Comments