MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1af805fa6bb25a314d61056ec06be067fef5a997f7b94ef9c51584e25b198f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1af805fa6bb25a314d61056ec06be067fef5a997f7b94ef9c51584e25b198f7
SHA3-384 hash: 31c41f08649e1387acf977c237f6ead40dcbbf48f9ab7f95150f15f9e69ad690e3f6a2ef0d4557f7429e4004020986f9
SHA1 hash: 782ddb2cbfdf482381adb2f5dd986b418f643ebd
MD5 hash: 959df2aa7f3da2cf6756789e38b4e30e
humanhash: bravo-summer-connecticut-cardinal
File name:DHL_CUSTOMERS_FORM.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'572'864 bytes
First seen:2020-07-02 09:32:03 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:vF4uVupuTyxwIzqNBP+E/JSvLH9Fnl4H444l+:vFypumW6qz+OSvLDl4H444l+
TLSH 0B7592293F409435D42CBD3247E99771D763AC822712CF0F7D89375A2AA26E67F0325A
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: clubspace8.vacationpubsandclubs.com
Sending IP: 69.36.182.206
From: DHL Express <customersservice@dhl.com>
Subject: DHL EzyBill – Invoice No: TNSR000153181
Attachment: DHL_CUSTOMERS_FORM.IMG (contains "DHL_CUSTOMERS_FORM.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Strictor.246631.18688.14880.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1af805fa6bb25a314d61056ec06be067fef5a997f7b94ef9c51584e25b198f7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 09:33:04 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6gxyax5gxms2gfgwcbloybv6az766wuzp55zj344kfme4jnrtd3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f1af805fa6bb25a314d61056ec06be067fef5a997f7b94ef9c51584e25b198f7

(this sample)

AgentTesla

Executable exe 5c60b2433bdccfbc378072d210448c92e0596617090e89f6aeb2b30b726169e2

  
Dropping
MD5 8b2aadf0b2a21ea8c0d354c8b5ce076b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5c60b2433bdccfbc378072d210448c92e0596617090e89f6aeb2b30b726169e2

Comments