MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 862ac294ff1eb2d62acb2c3b8dee56444769499c94234c2175b3bf2cd1fdef5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 862ac294ff1eb2d62acb2c3b8dee56444769499c94234c2175b3bf2cd1fdef5c
SHA3-384 hash: bf40d29b252e4334fb7d04bcdf1ee352246e6066c5f0c227bc26be3486c17141ab707d0425c75f3f677f0cb5d6a8b223
SHA1 hash: 28b1a3d3dec5031387dfbe0744622066df69664b
MD5 hash: a7680840014054610101441fc6b48c8c
humanhash: magazine-may-carolina-skylark
File name:DHL-RECEIPT1.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'394 bytes
First seen:2020-05-11 08:13:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FdXyNsIPVXDkx4KBfTsTN0w/yukgw7lzme2:XC2KVXDkxR+yLgwxw
TLSH 1B9423852518D11823B0F501F09A9EA999F4FE088D888C729F6CBFFB655E4F0D4D85FA
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 45.142.166.73
From: DHL=Delievery Service® <noreply@dhl.com>
Subject: DHL=Bill OF Lading DOCUMENT/INVOICE AWB Number: 6278216789
Attachment: DHL-RECEIPT1.rar (contains "gwhTD5I168ee7Dv.exe")

AgentTesla SMTP exfil server:
smtp.anding-tw.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Avemaria
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 08:36:45 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qyvmffh7d2znmkwlfq5y33swirdwssm4sqruyilvwo7szup555oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 862ac294ff1eb2d62acb2c3b8dee56444769499c94234c2175b3bf2cd1fdef5c

(this sample)

AgentTesla

Executable exe 74893a136da44e4042e65c516187ce393c6a388dd00bb8450afed5dafe9f8413

  
Dropping
MD5 8794178358a9649e24793702b01f6621
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74893a136da44e4042e65c516187ce393c6a388dd00bb8450afed5dafe9f8413

Comments