MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d93dc3aab2c374287f190c42e46e537a4be8755252059753d46aeb85f7975f86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d93dc3aab2c374287f190c42e46e537a4be8755252059753d46aeb85f7975f86
SHA3-384 hash: 6e10dadf079ed808e30e729e91b67c053ea9fd09bab7c19043d8573d12e87acbc47ea92ddf56e820d61d0e43e7fc0b96
SHA1 hash: 31214261ef11ce255a6ef83b2da3e9a77f27205f
MD5 hash: 3085ea444f56a8c4aad0267a8c3fc791
humanhash: nuts-minnesota-blossom-jersey
File name:SHIPPING DOCUMENTS.r09
Download: download sample
Signature AgentTesla
Create hunting rule
File size:988'888 bytes
First seen:2020-05-15 07:21:14 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 24576:cGf7P0ec7ZqIb4Tgjg64V1dcx8etFdnc1:cS7PoPkMjtlhc1
TLSH DE2533B6D29781F9E8DD1C36501EA46E28F740D4A0C56F3598F49F3953B2BC3C46889E
Reporter abuse_ch
Tags:AgentTesla DHL r09


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: DHL Logistics <paul.blackburn@warrant-group.com>
Subject: DHL Shipment Notification : 60882974631
Attachment: SHIPPING DOCUMENTS.r09 (contains "SHIPPING DOCUMENTS.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200515-0806.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 07:36:25 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3e64hkvsyn2cq7yzbrboi3stpjf6q5kskiczou6unlvyl54xl6da._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 d93dc3aab2c374287f190c42e46e537a4be8755252059753d46aeb85f7975f86

(this sample)

AgentTesla

Executable exe 6e9c73f1e1693475ae8b481a8209add81e9c578ff989b39946c6aa041d48bce7

  
Dropping
MD5 be8e8d221d706d518a4c5be47e210fd9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6e9c73f1e1693475ae8b481a8209add81e9c578ff989b39946c6aa041d48bce7

Comments