MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52af5649858eb55b471c9b684afe0996e6f62d6c21754f49ef23bfb58557376b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52af5649858eb55b471c9b684afe0996e6f62d6c21754f49ef23bfb58557376b
SHA3-384 hash: b150693419e37801f60f11c7fe9c3d1210ca80b4cf4941e39c3bfcf33e205ef15b1d75d22a5ab37a44bc4048c48edf99
SHA1 hash: e7b110b54737194648af474d7dc81cc3016d182e
MD5 hash: adaa13e634dfe462b670ccc29a379a75
humanhash: april-march-alaska-fix
File name:Ningbo Invoice for part shipped- Nov 19,2023.tar.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:815'616 bytes
First seen:2023-12-15 09:07:35 UTC
Last seen:Never
File type: tar
MIME type:application/x-tar
ssdeep 12288:hK0oLtTYwBGwwR/7R7TCffaz67lYu3c5dbMPGbZXtBuegs:jgNJwRTR7TyQ65Yus5hMQL
TLSH T1360512252248CA96C7DD32B54F90D57613749DAE6E02EA5239F52EDB32FF7A32001263
TrID 62.9% (.TAR/GTAR) TAR - Tape ARchive (GNU) (17/3)
37.0% (.TAR) TAR - Tape ARchive (file) (10/3)
Reporter cocaman
Tags:001 AgentTesla DHL INVOICE tar


Avatar
cocaman
Malicious email (T1566.001)
From: ""James Ni (DHL CN)" <james.ni@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [45.137.22.230]) "
Date: "14 Dec 2023 11:40:23 +0100"
Subject: "URGENT!!! Ningbo Invoice for part shipped on Nov 19,2023"
Attachment: "Ningbo Invoice for part shipped- Nov 19,2023.tar.001"

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Ningbo Invoice for part shipped- Nov 19,2023.exe
File size:814'080 bytes
SHA256 hash: 9dd7786a5c103076ba73cce2e2a3dad65a6a76684c781a86d924cddf9bffc8b3
MD5 hash: 39c7b5f079174655af3bdcd1256bd12a
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.30442.27022.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/657c17717d4bdb7f8bf47a30/reports/a0dbe196-a6da-41ec-a493-2c02d43a0085/overview
Verdict:
Malicious
Labled as:
Mal/DrodTar
Link:
https://www.hybrid-analysis.com/sample/52af5649858eb55b471c9b684afe0996e6f62d6c21754f49ef23bfb58557376b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52af5649858eb55b471c9b684afe0996e6f62d6c21754f49ef23bfb58557376b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-12-14 06:52:32 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
16 of 37 (43.24%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kkxvmsmfr22vwry4tnuev7qjs3tpmllmef2u6sppeo73lbkxg5vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52af5649858eb55b471c9b684afe0996e6f62d6c21754f49ef23bfb58557376b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

tar 52af5649858eb55b471c9b684afe0996e6f62d6c21754f49ef23bfb58557376b

(this sample)

AgentTesla

Executable exe 9dd7786a5c103076ba73cce2e2a3dad65a6a76684c781a86d924cddf9bffc8b3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9dd7786a5c103076ba73cce2e2a3dad65a6a76684c781a86d924cddf9bffc8b3
  
Dropping
AgentTesla
  
Dropping
MD5 39c7b5f079174655af3bdcd1256bd12a

Comments