MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2824d2c7625159e8f495f9c1932fc7a51001693713730c9994cf6ec9aa49328a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2824d2c7625159e8f495f9c1932fc7a51001693713730c9994cf6ec9aa49328a
SHA3-384 hash: fcb73f145e258d2994d5c0b6f8225c945a3d1ddb1b0ec856184933fcc5d2e5a6992d50d60d34cfb7818de86db748c051
SHA1 hash: 60e6b412f31dd0a04c9a27849d51cd1e8e14bed9
MD5 hash: 48dc41932cc7562759f465c993f3349b
humanhash: nine-may-robert-oregon
File name:DHL shipping documents.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:392'732 bytes
First seen:2020-06-08 06:06:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:JPmtKYXCve8E0zfyv2dncexIJhsKA+OKoxLyrV8f/IQiTKKHBmf1jnwRsbJtyQ5L:JP6KYXCvdTy0c+6h2K2yr4/IQvKhmf1v
TLSH 898423DDD0B34602C673CD8E6E69DA8E04B3C4BDA243366C9D4BC741D89A287FB58917
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns10.metro.net.bd
Sending IP: 103.36.103.52
From: DHL NZ <isla@dnl.com>
Subject: ✈ DHL shipment notice
Attachment: DHL shipping documents.iso (contains "KXunm5bl8xyHuMr.exe")

AgentTesla SMTP exfil server:
mail.prismindia.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:08:05 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fasnfr3ckfm6r5ev7hazgl6huuiac2jxcnzqzgmuz5xmtksjgkfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2824d2c7625159e8f495f9c1932fc7a51001693713730c9994cf6ec9aa49328a

(this sample)

AgentTesla

Executable exe cdfac7ca69379fdcad030db24eff90d5ee4ef276d450e79bea98793a6801854d

  
Dropping
MD5 4288d7a9d8d33f7aa22ad1d73065cf6e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdfac7ca69379fdcad030db24eff90d5ee4ef276d450e79bea98793a6801854d

Comments