MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 561224b12410c64e056ee806019b906608404e77953427589014c488372ca1e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 561224b12410c64e056ee806019b906608404e77953427589014c488372ca1e5
SHA3-384 hash: 84a8093769e2eff405d12fb3c5fc4bb544cd771c30e57a64148f5ae45b2af75a379d1e8eff40b176f49c5bcfb1b15358
SHA1 hash: 14d31893cadefcb8f95889dfa467acad144ff157
MD5 hash: c2411fbbfd2275a6fcc777fed3226d9f
humanhash: july-utah-pip-nebraska
File name:SHIPPING DOCUMENTS PDF.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:929'537 bytes
First seen:2020-06-18 05:33:47 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:hDIILOXTIGZ28gj3DFZL1s7/kTCkWovs8ghaMNwfCeIxk59/Nj6txinZDDYlIH:iZ2z1sjaUdcCeUk5TjcAVQIH
TLSH AD1533B608F49FFA29BB5FE6E87C853653459731A980A37A037D3084E4175DA314CBAC
Reporter cocaman
Tags:AgentTesla xz


Avatar
cocaman
Malicious email
From: Karen Wellsted <krunal.langhnoja@dhl.com>
Received: from dotsmail.itsoul.com (dotsmail.itsoul.com [107.6.134.141])
Date: Thu, 18 Jun 2020 05:25:08 +0530
Subject: SHIPPING DOCUMENTS
Attachment: SHIPPING DOCUMENTS PDF.xz

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 00:00:14 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kyjcjmjecdde4blo5adadg4qmyeeattxsu2coweqctciqnzmuhsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 561224b12410c64e056ee806019b906608404e77953427589014c488372ca1e5

(this sample)

AgentTesla

Executable exe 384f36ad8c67b24aab276a4b5c295cc0b2f690ca97d9ba854bce80b8f1e2031d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 384f36ad8c67b24aab276a4b5c295cc0b2f690ca97d9ba854bce80b8f1e2031d
  
Dropping
AgentTesla

Comments