MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7854ad463475bc9d35ced97b7aa41f62c033852b28fdcce925f7f6711e3c3986. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7854ad463475bc9d35ced97b7aa41f62c033852b28fdcce925f7f6711e3c3986
SHA3-384 hash: 11328ff3e8b139c9932ff7f2851479afb52031ac88a39d49ae672237ca0e39e54a155f0715eeff526c2b0fe6d29be69b
SHA1 hash: 10971b7b6627c89cce6f96f418b1fa2d7f14a604
MD5 hash: fe44560c182b950a93e96e2ece8f820c
humanhash: oregon-wyoming-pasta-six
File name:DHL.TRACKING.DETAILS.PDF.tar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:533'746 bytes
First seen:2021-03-09 06:36:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:p5XPVgTSYRH6WKy5Zx+lesG4Ie00Mce9vRxJfqaLueKR0op:eBzKyxnf4DtARxJflLuzn
TLSH 26B423D94FE30291ADA6057E0CBEE28949E51251C6C44E69FF33F0C09925BCBE168E5F
Reporter cocaman
Tags:DHL tar


Avatar
cocaman
Malicious email (T1566.001)
From: ""DHL Express Notification"<sales@carlinkmotors.com>" (likely spoofed)
Received: "from [66.154.98.110] (unknown [66.154.98.110]) "
Date: "9 Mar 2021 07:14:37 +0100"
Subject: "DHL Arrival Notification"
Attachment: "DHL.TRACKING.DETAILS.PDF.tar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.AJW.genEldorado.8286.9072.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 06:37:05 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pbkk2rruow6j2noo3f5xvja7mladhbjlfd64z2jf673hchr4hgda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7854ad463475bc9d35ced97b7aa41f62c033852b28fdcce925f7f6711e3c3986

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7854ad463475bc9d35ced97b7aa41f62c033852b28fdcce925f7f6711e3c3986

(this sample)

AgentTesla

Executable exe 80366e346ed1e69ec074215cbe6f086ed5c294792f999c547b3b495d2055fe3a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80366e346ed1e69ec074215cbe6f086ed5c294792f999c547b3b495d2055fe3a

Comments