MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23157428caf5d09713a7e74208c3a0fdd17be488dd889a668bb1f1e49fcd1a36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23157428caf5d09713a7e74208c3a0fdd17be488dd889a668bb1f1e49fcd1a36
SHA3-384 hash: 8f549fa2620bf3ac67afee89d971fa2a1aa3eb75683370cfd3f65b9d78b4537498dc6cbbca8106d857ca413b4268bac4
SHA1 hash: d6b7f2288ac16279de6a093f5f164822ecde880f
MD5 hash: 3f930a0568da86ffe676943da89499d3
humanhash: batman-may-kansas-fruit
File name:DHL-#AWB130501923096PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:583'011 bytes
First seen:2020-11-18 11:44:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:K+Teo4rtE0SKx8UHVoFGBvFtdvBwfO9vMYwIBpF:+o4KjwV4GBDdZ6AUmpF
TLSH 12C4238ED0E3EB6BF9C02426D178C8CBD0CE410975D212E36F25A84916E7F6442DEE9D
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""DHL" <myclearance@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [172.93.148.169]) "
Date: "18 Nov 2020 03:43:19 -0800"
Subject: "=?UTF-8?B?6ZyA6KaB6YeH5Y+W55qE6KGM5YqoIC0gUGxlYXNlIENvbmZpcm0gWW91ciBTaGlwbWVudCBBZGRyZXNz?="
Attachment: "DHL-#AWB130501923096PDF.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23157428caf5d09713a7e74208c3a0fdd17be488dd889a668bb1f1e49fcd1a36/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 04:03:51 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=emkxikgk6xijoe5h45barq5a7xixxzei3wejuzulwhy6jh6ndi3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 23157428caf5d09713a7e74208c3a0fdd17be488dd889a668bb1f1e49fcd1a36

(this sample)

AgentTesla

Executable exe 6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58
  
Dropping
AgentTesla

Comments