MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 719d2fabf7f810cae7d595c22cd2a9b5663c483326a9d4a1a35341bce92476c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 719d2fabf7f810cae7d595c22cd2a9b5663c483326a9d4a1a35341bce92476c9
SHA3-384 hash: bd69d2f9e9bd73b200617f1bf6991271cd0ea223135f9c9e2e6e7298e00a8385de931d5a85bce2e19b8d380a4203e851
SHA1 hash: 2f47158d51221d8245bcdb18f4aeadc6f5eb5dc4
MD5 hash: ffecae8aaf7d05db462a9bc2bbeece33
humanhash: rugby-may-tennessee-magazine
File name:Dhl _SHIPPING DOC - #0036284639289.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'441'792 bytes
First seen:2020-08-17 10:18:13 UTC
Last seen:2020-08-17 10:19:10 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:iHlYcrKanXHzeEjMx6p4ddVvjUip3GKfm8LonF/416tz4q3weRtb/qNRLCca79OL:iF7OuHzkK4d7403c8UnZ4YtNws/IRhL
TLSH 8765AE22A1E04837D1B22A7C8C1F7268B835BD103AF859477BE85D38BF3B6513565E87
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email
From: Dhlemailship <no-reply@dhl.com>
Received: from mail.sekawan.com (mail.sekawan.com [45.251.72.199])
Date: Mon, 17 Aug 2020 16:55:40 +0700
Subject: DHL : ARRIVAL NOTIFICATION!!! - SHIPPING DOC. COMMERCIAL INVOICE,
BILL OF LADING, & PACKING LIST A // Tracking No : KCLGQOE191781
Attachment: Dhl _SHIPPING DOC - #0036284639289.img

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/719d2fabf7f810cae7d595c22cd2a9b5663c483326a9d4a1a35341bce92476c9/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 10:20:07 UTC
File Type:
Binary (Archive)
Extracted files:
70
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ogos7k7x7aimvz6vsxbczuvjwvtdysbte2u5jindkna3z2jeo3eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/719d2fabf7f810cae7d595c22cd2a9b5663c483326a9d4a1a35341bce92476c9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 719d2fabf7f810cae7d595c22cd2a9b5663c483326a9d4a1a35341bce92476c9

(this sample)

AgentTesla

Executable exe f1fa38a7af43b4e73980d695a642334c857b3d2dedd819c428c1e3b450022394

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1fa38a7af43b4e73980d695a642334c857b3d2dedd819c428c1e3b450022394
  
Dropping
AgentTesla

Comments