MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 688e0da268220c61ee017c17a367c16fc7134660ed5429857cd36c4314691300. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 688e0da268220c61ee017c17a367c16fc7134660ed5429857cd36c4314691300
SHA3-384 hash: 06099ad081a235c0a7eac4a4e1104ed47c38794259a8878511553f183cd3be887c18f3f8fff4fe80261bf946d105c95c
SHA1 hash: 30b842e8e12f4f3ed777038efe7b976c62ee14ae
MD5 hash: 5b6fe4e559cd755379ad89ed545a9dc9
humanhash: jupiter-video-uniform-video
File name:DHL_August 2020 at 1.90_8BZ290_PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-14 10:53:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:1qUmaoD6ULUEZEhqAiCRjXwbCgW3MJxTBeFDEHwykoG4tis:1BoDPwEZE7JlpgWfFgwL8tV
TLSH 71451221B3434090D97925778236A22883F7930F2353D756F98F032BEF677EA4A159DA
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: servermarrones.residuos.cat
Sending IP: 51.89.20.142
From: DHL Customer Support <noreply@dhl.com>
Subject: Re: DHL Notification / DHL_AWB_001179303/ ETD
Attachment: DHL_August 2020 at 1.90_8BZ290_PDF.img (contains "DHL_August 2020 at 1.90_8BZ290_PDF.exe")

AgentTesla SMTP exfil server:
mail.beljemi.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.883fab6557e79dc7.18671.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/688e0da268220c61ee017c17a367c16fc7134660ed5429857cd36c4314691300/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:55:06 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncha3itieiggd3qbpql2gz6bn7drgrta5vkctbl42nwegfdjcmaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/688e0da268220c61ee017c17a367c16fc7134660ed5429857cd36c4314691300

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 688e0da268220c61ee017c17a367c16fc7134660ed5429857cd36c4314691300

(this sample)

AgentTesla

Executable exe 4786c4e0b64e49ed37f8215c2b6c778ec6c7b31a4d044cab66d46c904c6a7cba

  
Dropping
MD5 883fab6557e79dc73a7e4c27e7431a49
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4786c4e0b64e49ed37f8215c2b6c778ec6c7b31a4d044cab66d46c904c6a7cba

Comments