MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44a7244b566678e73919bfe4770a46b8bd6ee1815e1589957a9012b27cf9bd80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44a7244b566678e73919bfe4770a46b8bd6ee1815e1589957a9012b27cf9bd80
SHA3-384 hash: 1d91928b3c1ec44adf00190321e73a5836555f25ec7f521b0d843e3fa988104e90187b4bd2f2a668ed29888644fe79ca
SHA1 hash: c3d7f6ef93f78d50bcf7ac1766d8892c201d69c6
MD5 hash: 835893595b20f7a7bbfc4e31e4c1d154
humanhash: cat-wisconsin-two-west
File name:DHL AWB-14052020102.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'063 bytes
First seen:2020-05-14 11:18:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:LfqF9SbwcjTvO1ABsOvPR2KD4LxzgAj+EmkpUdhCJt0CFDTHi8xzm7uA1taG:q8b7rTBSLxzRPmKUdh+0cDTHi8xIuYaG
TLSH 6394233550FF2AE19D355F82C61E2DCA623AA0311117C49DCD68EFACFB7428CA4B252D
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.bengiamein.cf
Sending IP: 192.227.127.252
From: DHL AWB Shipment Notification<admin@bengiamein.cf>
Subject: DHL AWB Shipment Arrival Notification Waybill No. :140520200102
Attachment: DHL AWB-14052020102.rar (contains "DHL AWB-14052020102.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 11:36:03 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=istsis2wmz4oooizx7shocsgxc6w5ymblykytfl2sajle7hzxwaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 44a7244b566678e73919bfe4770a46b8bd6ee1815e1589957a9012b27cf9bd80

(this sample)

AgentTesla

Executable exe dab5aa425777ad0e35649ca3bdce0cbe92d8ef7652fb514f23011cd3af328442

  
Dropping
MD5 679a13dae51613c1439602a706df39fe
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dab5aa425777ad0e35649ca3bdce0cbe92d8ef7652fb514f23011cd3af328442

Comments