MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a42bb7429fc7b285edc50b2a8a6a539d89ae0eee7ef545103a91834c586c4487. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a42bb7429fc7b285edc50b2a8a6a539d89ae0eee7ef545103a91834c586c4487
SHA3-384 hash: 442b28dad93c1dac20cb67a90573d2f6a773cf41755ca927aa4646f7573582cb9e88cf02f441e46575d252befc0dd0f3
SHA1 hash: 2fc2760cffe17bf5574b12293eb33d1a1b2e0d8f
MD5 hash: 0591e988e5f5bb493761ccb1d1ed552f
humanhash: beryllium-coffee-bluebird-moon
File name:DHL EXPRESS AWB doc.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'377 bytes
First seen:2020-05-22 13:55:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Mi1dJPugdYg8sPPBseZyFGgVvTVCuPLtiDb:Mi13PugdYg9PSeZyTNLtw
TLSH F994233EE73149D9D0FB9F2505C4834DBBCC8A1BD0E20068AF389B628C15EB994759D5
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns1.arkansasappraisal.pw
Sending IP: 138.197.128.156
From: DHL EXpress Shipment<dhl@dhlservice.com>
Subject: DHL EXPRESS AWB NOTIFICATION
Attachment: DHL EXPRESS AWB doc.rar (contains "DHL EXPRESS AWB doc.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 14:35:59 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a42bb7429fc7b285edc50b2a8a6a539d89ae0eee7ef545103a91834c586c4487

(this sample)

AgentTesla

Executable exe 2b715e7e0b8239ab65ad9680f3a2f5b582bd488dd2926b8b7dcd178bd3239049

  
Dropping
MD5 5baab1cd4890f1d159d126da7259327c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b715e7e0b8239ab65ad9680f3a2f5b582bd488dd2926b8b7dcd178bd3239049

Comments