MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 414ac3b426347d733d3b317ed2c79ad1ffef30586618ef6c405a2bb9f8ecb46b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 414ac3b426347d733d3b317ed2c79ad1ffef30586618ef6c405a2bb9f8ecb46b
SHA3-384 hash: fd6cc9429ba05c7033a3cbfb85f001565481d2273495ca0153a7bb003ff79ec1b05e6d54df00b0435e8368c669d12055
SHA1 hash: 045105280ef688f314b60fb33d784cbbd2480af4
MD5 hash: 68aa8f0e1a172c1067b9162d52fd5ff5
humanhash: hydrogen-blossom-maryland-fifteen
File name:DHL_AWB_INV_9882900_99862788_998.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:614'400 bytes
First seen:2020-07-21 14:28:52 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:od9JaNChgTLirEOSyRw6TBXBP+faVXL5598gozqDqdGIWv0yySPLpYOirOuZieUM:NN/q9NV75598gOsIWu8LEJ7tMi
TLSH 25D48B10D7F88ACAE7BE57BDE460010087B4B50AA7EAE7591B90F0ED1962751CB53F23
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: racknerd-2b600a.localdomain
Sending IP: 66.152.189.117
From: DHL | Express Shipping <dhlexpress.billingid@dhl.com>
Subject: Urgent: Shipping Documents (Reminder)
Attachment: DHL_AWB_INV_9882900_99862788_998.img (contains "DHL_AWB_INV_9882900_99862788_998.exe")

AgentTesla SMTP exfil server:
smtp.tpts4seed.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/414ac3b426347d733d3b317ed2c79ad1ffef30586618ef6c405a2bb9f8ecb46b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 14:30:08 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iffmhnbggr6xgpj3gf7nfr422h766mcymymo63caliv3t6hmwrvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legal
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/414ac3b426347d733d3b317ed2c79ad1ffef30586618ef6c405a2bb9f8ecb46b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 414ac3b426347d733d3b317ed2c79ad1ffef30586618ef6c405a2bb9f8ecb46b

(this sample)

AgentTesla

Executable exe 4db8e3d8e29d6518086087c14ade8e22040bb81d6298f1eb23b893e7581eeb5c

  
Dropping
MD5 0b5b259d171212bb43dd2097ef69642d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4db8e3d8e29d6518086087c14ade8e22040bb81d6298f1eb23b893e7581eeb5c

Comments