MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 378dd4221ada0f347f6d6b600057baf62c8b79119a81e25e40103a25d8bc2e02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 378dd4221ada0f347f6d6b600057baf62c8b79119a81e25e40103a25d8bc2e02
SHA3-384 hash: 8b0da173fd532f077cef7587ac0dce65ab421869d6e76c505edc87cc8788e358fbd48723712aad54961615d5270181b8
SHA1 hash: 7a44cfa4dad02a456c1adef6aee6e3cd4bc5f9a0
MD5 hash: 2098610de9b1ccaf89042a864b8c1a4f
humanhash: quiet-alanine-item-april
File name:Delivery Note - AWD 200038485852- 2349203968876.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:883'290 bytes
First seen:2020-08-05 08:41:21 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:EHCYrp5Gg1di8Sutu4dslRfT1ygHOm6yelH0:EiYaFau9lyC19
TLSH B61533AB8FE271F0A058CF631F3AF1D5E85639C1B2B64B241B9A811C3715867E48D727
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ptmatsuo.co.id
Sending IP: 202.74.72.84
From: DHL Express <katewright_dhl@gmail.com>
Subject: Failed DHL Delivery Notification
Attachment: Delivery Note - AWD 200038485852- 2349203968876.gz (contains "Delivery Note - AWD 200038485852- 2349203968876.exe")

AgentTesla FTP exfil server:
ftp.becommodal.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/378dd4221ada0f347f6d6b600057baf62c8b79119a81e25e40103a25d8bc2e02/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:43:04 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6g5iiq23ihti73nnnqaav526ywiw6irtka6exsaca5clwf4fyba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/378dd4221ada0f347f6d6b600057baf62c8b79119a81e25e40103a25d8bc2e02

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 378dd4221ada0f347f6d6b600057baf62c8b79119a81e25e40103a25d8bc2e02

(this sample)

AgentTesla

Executable exe 101e9ffa490332914503c3350dd4cd4550157597369fdf9261aa345ed7b86d55

  
Dropping
MD5 2ad53010142706869e768ad4e220e98f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 101e9ffa490332914503c3350dd4cd4550157597369fdf9261aa345ed7b86d55

Comments