MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4b675daa6c54e06962ef1162fd7fe105fe9e76193626ec451dda29081cab3582. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 5
| SHA256 hash: | 4b675daa6c54e06962ef1162fd7fe105fe9e76193626ec451dda29081cab3582 |
|---|---|
| SHA3-384 hash: | 959600c3ace5be8b27751c3ec976c156d3dbfcd89f95d89c4d5c0ba1daaa508fc33f9a09e2eac7537d55f1202c568a6f |
| SHA1 hash: | 2ecc1ac4325fd994336904c3d8126ec91b93efda |
| MD5 hash: | f786e547403c0dff7eda565cb5cb7c1b |
| humanhash: | jig-neptune-queen-undress |
| File name: | DHL11-05-2020.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'204'736 bytes |
| First seen: | 2020-05-11 08:49:31 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 94ac44d361a5151c3b27c7d1a876a7f3 (14 x AgentTesla, 4 x Loki, 1 x NetWire) |
| ssdeep | 24576:KGfM18WnMVuvk591FKN3vuawP7UumPTfXZCGdvP/iav:K03z91Y/u9jfmPThCGZPKS |
| Threatray | 2'841 similar samples on MalwareBazaar |
| TLSH | 9E45E121F6B01437C1321AFD4D5B56ACA92BBE513928994E2BD71F4C9F3B681392B1C3 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla DHL exe geo TWN |
abuse_ch
Malspam distributing AgentTesla:HELO: hosting12.ji-net.com
Sending IP: 203.130.149.250
From: tw.customercare@dhl.com
Subject: DHL Express้้็ขบ่ชๆธ
Attachment: DHL11-05-2020.zip (contains "DHL11-05-2020.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-11 01:10:33 UTC
File Type:
PE (Exe)
Extracted files:
395
AV detection:
28 of 31 (90.32%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Similar samples:
+ 2'831 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
family:masslogger spyware stealer upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
UPX packed file
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.