MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a1236352dcc986a21a3741061e031f4b2ced0ad3b1d9b35977685bc7b43f223. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a1236352dcc986a21a3741061e031f4b2ced0ad3b1d9b35977685bc7b43f223
SHA3-384 hash: 95f0142cce09762adeff27c7b7fff56c46595e62967c6280c4646c4e4ce4e92ad49edeb442e8a3000dbc306e9b8b150f
SHA1 hash: f3df4719d3ddb684f5c7763ea9447265382be6a0
MD5 hash: 8402980ca2008f6b4d971b0fa1d618a6
humanhash: cola-ohio-michigan-delaware
File name:DHL_FORM14PDF.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:706'560 bytes
First seen:2020-08-03 13:49:08 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:olHAgbCa8sGQTIIyegBGSqprh60g1vS/T0TZLDzpZvV2:olHX8kT306taS/a
TLSH 61E419392A83A514D93D093548A469D1A7B2758A3F12CB0F39CA169C6F43BCF3F4725E
Reporter abuse_ch
Tags:AgentTesla DEU DHL geo iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.sepsi.ro
Sending IP: 93.115.174.140
From: DHL EXPRESS LIEFERUNG <luis.caceres@dhl.com>
Reply-To: svsu@primariadaiaromana.ro
Subject: DHL E-Benachrichtigung
Attachment: DHL_FORM14PDF.iso (contains "DHL_FORM14PDF.exe")

AgentTesla FTP exfil server:
ftp.solarcenter.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a1236352dcc986a21a3741061e031f4b2ced0ad3b1d9b35977685bc7b43f223/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:51:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fijdmnjnzsmguindoqigdybr6szm5ufnhmozwnmxo2c3y62d6irq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2a1236352dcc986a21a3741061e031f4b2ced0ad3b1d9b35977685bc7b43f223

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 2a1236352dcc986a21a3741061e031f4b2ced0ad3b1d9b35977685bc7b43f223

(this sample)

AgentTesla

Executable exe f76f30e19634b3048717ccf6f127b75a5e1dc287d294b5ac4c49b7b5efb44598

  
Dropping
MD5 7a41850990a9504b0c86b0216a87f405
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f76f30e19634b3048717ccf6f127b75a5e1dc287d294b5ac4c49b7b5efb44598

Comments