MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4f2cb9bf45295308a568cf2f84c850e13d8f85d482a7ccd324b0f52cbaa307b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4f2cb9bf45295308a568cf2f84c850e13d8f85d482a7ccd324b0f52cbaa307b
SHA3-384 hash: 8f647b92a955f5f7ea865c6623d4f1d9419cf6a2629aa6d5f88f9f2a15d83dbd671f0d20929a37266df3a5e7c4f4ed0d
SHA1 hash: 9e09af06f93f8f42d19c7491cc442db83a22f23c
MD5 hash: fc8d6f1e0682c32454e8f13d3d3ecdec
humanhash: beryllium-nitrogen-rugby-autumn
File name:Shipping doc.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:444'759 bytes
First seen:2020-05-27 11:34:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:TaOf6oP1k5gFaOmq4tf+V2/+EDeCyb2JhoXP:uQP4gFawof+I/+0eCyb2m
TLSH A39423608DB714FE97DDD078E5866B9D1382437442838EC3D2D8B00B1B6D6ADE88376D
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.smartadspublishing.com
Sending IP: 192.163.230.13
From: DHL <a.valino@drugcheck.ph>
Subject: Shipping Document
Attachment: Shipping doc.rar (contains "Shipping doc.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 11:35:45 UTC
File Type:
Binary (Archive)
Extracted files:
274
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b4f2cb9bf45295308a568cf2f84c850e13d8f85d482a7ccd324b0f52cbaa307b

(this sample)

AgentTesla

Executable exe 482fb3d84c859355f206c06e5fd0acd7ac249d490f515389487ab611e0eb473e

  
Dropping
MD5 f1b61af88bbbb493d93a8aede788b3ca
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 482fb3d84c859355f206c06e5fd0acd7ac249d490f515389487ab611e0eb473e

Comments