MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 162f1e6e446fb3689f7b35393de3a2a781dc4f1e018611ab88ce9b781fa1d847. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 162f1e6e446fb3689f7b35393de3a2a781dc4f1e018611ab88ce9b781fa1d847
SHA3-384 hash: 5603d543150df8ec91f1edaaf0e7f7153eb9d4c99f4eed9f5c5d4b81f2f4396aa075f6653e73066f10059a2773acfd9e
SHA1 hash: 15d4a96edd1146393f6736450c1558fb168e7d8c
MD5 hash: a02b13739448e08eacfcf1fa131f82f8
humanhash: river-diet-delaware-mars
File name:Tax_Invoice 965496112.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:724'054 bytes
First seen:2020-08-18 11:18:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:hJBUSyHDZSzzdk35XkEYBe615iQNtWWLEQL65ViVRAftMU0NHU+ImN:tQHUdkJXkBeYN+n9UH3Ik
TLSH 70F4237661C8C6CED9FA7F67DE989FA35056BD1015D2C99ACFC460CE38087A90F9C608
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: swn0.701.zazomika.ml
Sending IP: 165.232.42.37
From: DHL INTERNATIONAL <selicnclr@701.zazomika.ml>
Subject: [DHL] Information on import tax invoice (965496112)
Attachment: Tax_Invoice 965496112.gz (contains "Tax_Invoice 965496112.exe")

AgentTesla SMTP exfil server:
mail.kemyo.lk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.RatNET.2.27528.17296.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/162f1e6e446fb3689f7b35393de3a2a781dc4f1e018611ab88ce9b781fa1d847/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:20:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cyxr43sen6zwrh33gu4t3y5cu6a5yty6agdbdk4iz2nxqh5b3bdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 162f1e6e446fb3689f7b35393de3a2a781dc4f1e018611ab88ce9b781fa1d847

(this sample)

AgentTesla

Executable exe 254920e6788f4cb4975f08c5deef07e932f4a370a38c5197d7a4fb7846ea63ae

  
Dropping
MD5 d047bd852813fb0cd3f93bc0bacaabdd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 254920e6788f4cb4975f08c5deef07e932f4a370a38c5197d7a4fb7846ea63ae

Comments