MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64522b779af96d43a90071388fe995d41767144f2e3d0bd04a29fe1753cd3ec8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64522b779af96d43a90071388fe995d41767144f2e3d0bd04a29fe1753cd3ec8
SHA3-384 hash: 75af344c8df1a13011ad265c04b570c442582a4d7bcd6dde349090baeb68ef0984aa5563b477694eaf861282bc985fe2
SHA1 hash: bc510bcf8dac12789a1c0e8a0f779db264856a00
MD5 hash: 0090f4ec95b0d14c7fb70ddb88ba4c98
humanhash: coffee-sink-twenty-twelve
File name:6323517185_IN...200722_391.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:402'200 bytes
First seen:2020-07-29 06:50:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:iQndYZkZfgE+XFomm05qTIHizEgmoEC0cAvvfjqzEcPrdmtlmdCpdOSQB:mCfg/Ejq11pvfjRcj40adOSe
TLSH E68423230AA690FF26E62B730136B07562FD90905C60D0BDD9F8D3713EDD2F91AA55C6
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps12232936.123-vps.co.uk
Sending IP: 212.67.215.65
From: DHL EXPRESS <LIM.soYoung@dhl.com>
Subject: FW: DHL 6323517185 (FORMOSAN ARSENAL GROUP CO LTD)-货物到达（计划）信息
Attachment: 6323517185_IN...200722_391.rar (contains "6323517185_IN...200722_391.exe")

AgentTesla SMTP exfil server:
mail.c67976.sgvps.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64522b779af96d43a90071388fe995d41767144f2e3d0bd04a29fe1753cd3ec8/
Threat name:
Win32.Trojan.DataStealer
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:52:08 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mrjcw5427fwuhkiaoe4i72mv2qlwofcpfy6qxuckfh7bou6nh3ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/64522b779af96d43a90071388fe995d41767144f2e3d0bd04a29fe1753cd3ec8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 64522b779af96d43a90071388fe995d41767144f2e3d0bd04a29fe1753cd3ec8

(this sample)

AgentTesla

Executable exe 636ccfc9b0b3e9336e0eb35e7a795097fa5a7908799a738142af28c08a631285

  
Dropping
MD5 83dd30341ed7c2d4289553f52c4309e3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 636ccfc9b0b3e9336e0eb35e7a795097fa5a7908799a738142af28c08a631285

Comments