MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c822a3d25176e5fa147c6ed47cc3ad99b34c8b0768aca882e29d66738c111cd7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c822a3d25176e5fa147c6ed47cc3ad99b34c8b0768aca882e29d66738c111cd7
SHA3-384 hash: 0c5d58a0689f1f56a088e1059b351c812733a3d77c4a3bd33f1e2a380100bcd7c42bd9c8442f3900a881673039398c5b
SHA1 hash: eadf7c8df255f85752be4717901a810c400e8eec
MD5 hash: dac67c0ba34de014ea9db1127a399065
humanhash: oklahoma-happy-nitrogen-eighteen
File name:DHL_Receipt_106_9882_671.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:933'888 bytes
First seen:2020-08-18 11:39:09 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:uS1QbvgWK5WpLv9hcE1F5/qrGzfPCwq0TS1jR5ITmLTh:bQbvxaW5h1FhqrGzHCwqrIyR
TLSH 0E15F7393A856C18D53E567110E86AC1B331A18B3E81CB1F7ACF43DE6F0269B3B9615D
Reporter abuse_ch
Tags:AgentTesla DHL Hotwinds iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-755267.hostwindsdns.com
Sending IP: 104.168.176.44
From: DHL Express <contact@service-immo.com>
Subject: DHL Delayed Parcel No: 106-9882-671 Download Print Receipt
Attachment: DHL_Receipt_106_9882_671.iso (contains "DHL_Receipt_106_9882_671.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c822a3d25176e5fa147c6ed47cc3ad99b34c8b0768aca882e29d66738c111cd7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:41:04 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zarkhusro3s7ufd4n3khzq5ntgzuzcyhncwkraxctvthhdardtlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c822a3d25176e5fa147c6ed47cc3ad99b34c8b0768aca882e29d66738c111cd7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso c822a3d25176e5fa147c6ed47cc3ad99b34c8b0768aca882e29d66738c111cd7

(this sample)

AgentTesla

Executable exe 0442367788ead3ccf0c9a36805053be48c332ab656f51667f4c08cbbfa3f3ac0

  
Dropping
MD5 d65a37653012ce0c0a177456458a465c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0442367788ead3ccf0c9a36805053be48c332ab656f51667f4c08cbbfa3f3ac0

Comments