MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e8fbf1440b82ff34d1fb7c29b707a5471a3b2a0a832e5a3191cfb0e9bc01c79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e8fbf1440b82ff34d1fb7c29b707a5471a3b2a0a832e5a3191cfb0e9bc01c79
SHA3-384 hash: 4d4cdb9b4989b6bd6ab43c0b1e77a9ef336cfb087ba943e08e70d166d671d9df02dcd134a5014d7128b1e1669c00d998
SHA1 hash: 7ce20b3cbbc227d5bda74eb4bd1eec965e62b1e7
MD5 hash: 3140761123fceea205b734b794cc649d
humanhash: low-twelve-burger-solar
File name:DHL_August 2020 at 1.20_8BZ290_PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-12 18:30:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:2rvJPbA4X9hMmO3DkwTdNz7B6PhtBKCPHXwb3eEZjOJxHB+VNEHbg8csEkys:2rvhbA4X9fwnzYHDvUVlVWozU
TLSH 8445F09776A24091C425613BE7B6935443F287031263D32AF0CF139B5F43BFE5A6A6CA
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: servermarrones.residuos.cat
Sending IP: 51.89.20.142
From: DHL Customer Support <noreply@dhl.com>
Subject: Re: DHL Notification / DHL_AWB_001179303/ ETD
Attachment: DHL_August 2020 at 1.20_8BZ290_PDF.img (contains "DHL_August 2020 at 1.20_8BZ290_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis0B4A939EAFC3.27101.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e8fbf1440b82ff34d1fb7c29b707a5471a3b2a0a832e5a3191cfb0e9bc01c79/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 18:32:10 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p2h36fcaxax7gti7w7bjw4d2kry2hmvavazoliyzdt5q5g6adr4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e8fbf1440b82ff34d1fb7c29b707a5471a3b2a0a832e5a3191cfb0e9bc01c79

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 7e8fbf1440b82ff34d1fb7c29b707a5471a3b2a0a832e5a3191cfb0e9bc01c79

(this sample)

AgentTesla

Executable exe fc87713edf4f4aa23cf04040a4f47604550b4ca2da324c0c3daf4fdcac6fa17f

  
Dropping
MD5 0b4a939eafc3871c41a8bb4c4a1c05a4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc87713edf4f4aa23cf04040a4f47604550b4ca2da324c0c3daf4fdcac6fa17f

Comments