MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45f7de0a4fb679b83cb9564e0b0dc101bc1ce2964b43e4fc4be20d7c3552d215. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45f7de0a4fb679b83cb9564e0b0dc101bc1ce2964b43e4fc4be20d7c3552d215
SHA3-384 hash: 5b7ca81d499ddcfcd0fc4c57a45f2c9b93d83fbae354b22e25ee2ee8110b007fa262dbeb9bab2404c6c23e647190b52a
SHA1 hash: 70c3fd569b8ef464f1681b343fbe61053d2a071a
MD5 hash: 9ceecbc52ef9d44e36be63d173bbef55
humanhash: hot-hawaii-shade-leopard
File name:Dispatch Details.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:456'299 bytes
First seen:2020-08-12 18:12:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:J12nsVBwGwNysaHoprE60RkYwJ1X+2snyVlU:msVBgyuERxwPX+arU
TLSH 50A4233C75F4EEF260BF5B414E7042BAA2327CE6386409BA045F6A1A541F9F07295FC2
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lebanonhost.denver.wehostwebsites.com
Sending IP: 72.18.154.62
From: DHL Express LTD<info@dhl.com>
Reply-To: <annewilegama@gmail.com>
Subject: Re: order dispatch documents
Attachment: Dispatch Details.pdf.rar (contains "Dispatch Details.exe")

AgentTesla SMTP exfil server:
mail.ozoneworks.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45f7de0a4fb679b83cb9564e0b0dc101bc1ce2964b43e4fc4be20d7c3552d215/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 18:14:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ix354cspwz43qpfzkzhawdobag6bzyuwjnb6j7cl4igxynks2ikq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/45f7de0a4fb679b83cb9564e0b0dc101bc1ce2964b43e4fc4be20d7c3552d215

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 45f7de0a4fb679b83cb9564e0b0dc101bc1ce2964b43e4fc4be20d7c3552d215

(this sample)

AgentTesla

Executable exe a384816b481c92571f603a60f84b5a4cf57a6422c55c3fffe17d5dd0e85a5034

  
Dropping
MD5 0dd86b0c43f54c9f582ba37f558c0b44
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a384816b481c92571f603a60f84b5a4cf57a6422c55c3fffe17d5dd0e85a5034

Comments