MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27f8e32231e08fe9a8d9085a9b4d3ae2dd2de7bb1832c992ff40088ecd6a4215. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27f8e32231e08fe9a8d9085a9b4d3ae2dd2de7bb1832c992ff40088ecd6a4215
SHA3-384 hash: ebdfd09aa262befdd9e904ac18e7caf82e5a5057227f9b42907011ace1fbb49b3b7b549fb6fe0086d9d819419dd557b5
SHA1 hash: bf99e4ddeb92d265cb4829a2c9bf0b695bda8479
MD5 hash: 9d80a57a36ef08d4dee5b0253428f299
humanhash: oven-crazy-texas-sixteen
File name:AWB 673687387678 DHL8735679093.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'656'832 bytes
First seen:2020-04-30 07:53:21 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:W4lavt0LkLL9IMixoEgeanFve7mXsUpstiqBm8SrBcieqkGz/zQq9MmCS:hkwkn9IMHean1Ns5Q8kBdeqUaPCS
TLSH 3775BE0223BA8296EA7F513379117701BE6BA8143761FCF72FB84538A9110E15F3966F
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.chittaranjan.co.in
Sending IP: 138.128.180.226
From: DHL Express ™ <support@dhl.com>
Subject: DHL Shipment Notification : 7348255141
Attachment: AWB 673687387678 DHL8735679093.iso (contains "AWB 673687387678 DHL8735679093.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 00:38:44 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e74ogirr4ch6tkgzbbnjwtj24los3z53dazmtex7iaei5tlkiikq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 27f8e32231e08fe9a8d9085a9b4d3ae2dd2de7bb1832c992ff40088ecd6a4215

(this sample)

AgentTesla

Executable exe afa655613277fa5927ea6e777245abc8812101008ff0d542efd12b9ec4d9e17c

  
Dropping
MD5 d3de35e32bd5e7128e956059354a49f1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 afa655613277fa5927ea6e777245abc8812101008ff0d542efd12b9ec4d9e17c

Comments