MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f1d138c47c7316460a6af976b2b6d9d6ee2387a6a256c0de6297a55336add5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	6f1d138c47c7316460a6af976b2b6d9d6ee2387a6a256c0de6297a55336add5b
SHA3-384 hash:	11e321c0d863a39639b9cb05124cba23fad71fb6921bd64d47754b7b711093962dd71c3c68188e7ad435dfb9a76cc294
SHA1 hash:	960d4e9116fea04b5cc8dd931aecab3401a30144
MD5 hash:	3566f6a0dd4a6d8f61306ca3b007066e
humanhash:	east-foxtrot-timing-enemy
File name:	Assigned Documents.img
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'441'792 bytes
First seen:	2020-08-06 07:56:09 UTC
Last seen:	2020-08-06 07:56:30 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	24576:BdVp8kIVfiwzsTZYkdq+xCcMKJSmzxzIa1:BjNGs9YkYUCtUSa1
TLSH	676512D7DA10C0ABFDB94A70256A2E9427A5AE1D60CE530BBF4D3A1873B31530D0F997
Reporter	abuse_ch
Tags:	AgentTesla DHL img NetWire nVpn RAT

abuse_ch

Malspam distributing NetWire:

HELO: box.wetranservice.xyz
Sending IP: 142.11.206.237
From: Wiji Krismiati (DHL) <ldh@wetranservice.xyz>
Subject: Description: AGREEMENT, ETC DOC
Attachment: Assigned Documents.img (contains "DHL Receipt.exe")

NetWire RAT C2:
bushaka009.duckdns.org:1982 (79.134.225.76)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE