MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 112c154c090e81ebbca399b036c6ff97ab65ba58c04286cf50b9c44c7e0325e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 112c154c090e81ebbca399b036c6ff97ab65ba58c04286cf50b9c44c7e0325e3
SHA3-384 hash: c82b85aed321b292899d84e735717d2ab805707cedf9cada779c96b70422b0ea0a46f0730c4143662eceab78626668b5
SHA1 hash: ce9a0b60de938e077fa201f648fdb78e06b54d7d
MD5 hash: f6f4c4f56ecb22252d76e902e66fc89a
humanhash: arkansas-pennsylvania-uniform-ten
File name:Consignment Documents PLBL Draft.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:479'019 bytes
First seen:2020-04-30 06:06:15 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:Wo7L6/lk9yUhCelFU53pQd/LUt1qEIkh5GGtafyydQCGpSIVYdmG8WMRP8wUlEj:Wtk9y0dqqg7MwIyyFEHRPxBj
TLSH 9BA4333356E5FFD80C16FD8B154263B83B1E1BAF1DAC90EEB6A134467B0E0D965C2249
Reporter abuse_ch
Tags:AgentTesla DHL r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-112157.us-midwest-1.nxcli.net
Sending IP: 209.126.25.164
From: DHL EXPRESS <support@dhl.com>
Subject: Consignment Notification: You have A Package With Us
Attachment: Consignment Documents PLBL Draft.r00 (contains "Consignment Documents PL&BL Draft.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 15:44:38 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cewbktajb2a6xpfdtgydnrx7s6vwlosyybbint2qxhcey7qdexrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 112c154c090e81ebbca399b036c6ff97ab65ba58c04286cf50b9c44c7e0325e3

(this sample)

AgentTesla

Executable exe d36325c4e5d94107b550c1bea0edb4f5e6854f83ee11294685a337af71683f6a

  
Dropping
MD5 8e4c7c62f1e644552df5dfb9c2e7c955
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d36325c4e5d94107b550c1bea0edb4f5e6854f83ee11294685a337af71683f6a

Comments