MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c0b56e8295d673d861806f7fa9066bdb26a76e4676dc3e8fab7ea323ff7e0a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c0b56e8295d673d861806f7fa9066bdb26a76e4676dc3e8fab7ea323ff7e0a0
SHA3-384 hash: 865aca704cf88ee4ca074601705d7d5301789878f78020e94e2a10ec1462eb518a39e569b47fa151a450aab2934272b9
SHA1 hash: 5aa0d452fc197f2aabcd941dc331862958edf2ef
MD5 hash: 78562689a15c23fecf5d14082a6dbcbc
humanhash: april-thirteen-johnny-butter
File name:DHL_Confirmation_CBJ190517000131TKKR.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:960'273 bytes
First seen:2020-05-26 10:02:56 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 24576:hj49AU6P6ou9OJy4di5pCXGwudNTQZcEUc7y:ByX6P6f9OJy4E5RnPQZcE/7y
TLSH 391533FE291494F2861FF7F382D8656B5E122B08A53688B9EF0C7F47C4433D21669D26
Reporter abuse_ch
Tags:AgentTesla arj DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: anchorai.pw
Sending IP: 173.82.243.236
From: DHL <info@anchorai.pw>
Subject: Confirmation CBJ190517000131
Attachment: DHL_Confirmation_CBJ190517000131TKKR.arj (contains "DHL_Confirmation_CBJ190517000131TKKR.exe")

AgentTesla SMTP exfil server:
smtp.homecares-tw.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 10:36:52 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 9c0b56e8295d673d861806f7fa9066bdb26a76e4676dc3e8fab7ea323ff7e0a0

(this sample)

AgentTesla

Executable exe c62e6a976a7999cc933cdb42e0d6eb0be6dbc979a0d0ef2a3143e6e0a4fb5c7f

  
Dropping
MD5 dcdb13390c5e046d05747765844c7ccb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c62e6a976a7999cc933cdb42e0d6eb0be6dbc979a0d0ef2a3143e6e0a4fb5c7f

Comments