MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72035c166ca9a3a24c09f8d6ed920db840fe468f84a49ffc97949f1bc023a5c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72035c166ca9a3a24c09f8d6ed920db840fe468f84a49ffc97949f1bc023a5c7
SHA3-384 hash: fe55208cf506ddaea964f4190476c0c127cb327ab91df5d135bc690b131ba3b006bde51ddc51d27a45df9fd791915e68
SHA1 hash: 13dda7d6c2b63d7f48e4fce80a7be6a15baa6a88
MD5 hash: bf11d06e4f81113e9fb47cd05d5a26dd
humanhash: zulu-october-don-apart
File name:Dhl _SHIPPING DOC - 0036284639289.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'441'792 bytes
First seen:2020-08-18 12:46:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:P+p7p8KESESHe4/gD6WDSqWl/LDGTGM5irKdTdDYidCIf+fVlp2NgzDl:etRES4DBSq2KG2bd9Y2op2
TLSH 29658D22B6D047FFC126253DBC1B93747829BE1C2A285D876BE56C4F6F2E6413439293
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.sekawan.com
Sending IP: 45.251.72.199
From: Dhlemailship <no-reply@dhl.com>
Subject: DHL : ARRIVAL NOTIFICATION!!! - SHIPPING DOC. COMMERCIAL INVOICE, BILL OF LADING, & PACKING LIST A // Tracking No : KCLGQOE191781
Attachment: Dhl _SHIPPING DOC - 0036284639289.img (contains "dhl.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72035c166ca9a3a24c09f8d6ed920db840fe468f84a49ffc97949f1bc023a5c7/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 08:43:35 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oibvyftmvgr2etaj7dlo3eqnxbap4rupqssj77exssprxqbduxdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72035c166ca9a3a24c09f8d6ed920db840fe468f84a49ffc97949f1bc023a5c7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 72035c166ca9a3a24c09f8d6ed920db840fe468f84a49ffc97949f1bc023a5c7

(this sample)

AgentTesla

Executable exe 4c1f7b054a32f5718b35f036d5600b67afd54f044326c505af63c6d705c9f9bb

  
Dropping
MD5 170652745b338fa5645c1eeebf52d554
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c1f7b054a32f5718b35f036d5600b67afd54f044326c505af63c6d705c9f9bb

Comments