MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 357af4af8b583038762d8eda0e556240fbe6d57b0875f3e4e8827af5ec122d8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 357af4af8b583038762d8eda0e556240fbe6d57b0875f3e4e8827af5ec122d8b
SHA3-384 hash: 179106df660e9285072e9d28fa1d4f4b7b8a308a2c4cc38eb420c39902dc5fd7ff25a41c4b2be89ef2d47c820d9143f6
SHA1 hash: a0d16a3b7518c48a269c7721e8a0ae4a6683141b
MD5 hash: a24197fabfa73e7e485a5fbb1fa52f70
humanhash: south-lamp-tango-rugby
File name:30714756.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:578'554 bytes
First seen:2021-01-13 20:16:54 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:AaFZ8f7UdoqXn0ToECpTGiMZp7ofw3DYMu+RlLoFNWxWEwnazp:Atf7Ud7X0bCpTtMZdofw3DHuo0sRQEp
TLSH E8C423ED28C4C4F9E82B56D216F1E6C5EE5584F3CDE6475E20B92BD4B73042938339A2
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.websitesmalaysia.com
Sending IP: 103.233.1.132
From: DHL EXPRESS© <autoreply@dhl-supply.com>
Reply-To: DHL EXPRESS© <nicolasdiegonicolas@gmail.com>, DHL EXPRESS© <nicolasdiegonicolas@gmail.com>
Subject: DHL Commercial Invoice {30714756}
Attachment: 30714756.gz (contains "30714756.exe")

AgentTesla SMTP exfil server:
smtp.vivaldi.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/357af4af8b583038762d8eda0e556240fbe6d57b0875f3e4e8827af5ec122d8b/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 20:17:13 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gv5pjl4llaydq5rnr3na4vlcid56nvl3bb27hzhiqj5pl3asfwfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/357af4af8b583038762d8eda0e556240fbe6d57b0875f3e4e8827af5ec122d8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 357af4af8b583038762d8eda0e556240fbe6d57b0875f3e4e8827af5ec122d8b

(this sample)

AgentTesla

Executable exe 1d12e0ea21ddb6f39d309e836c5f8e2c3fcfd4c167b20185ca3723233230bb8b

  
Dropping
MD5 c1279eb7ba4c37f73765233d8ce917d5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d12e0ea21ddb6f39d309e836c5f8e2c3fcfd4c167b20185ca3723233230bb8b

Comments