MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92be83007a8a0f17e3fc399f64c4b80728cffc24be0875ffeefe01d940247503. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92be83007a8a0f17e3fc399f64c4b80728cffc24be0875ffeefe01d940247503
SHA3-384 hash: 0daa4b8a1f3c1f70a9fc638b29fbd12d222ddd6e5581880856c83bb6553d7c9f75b279a0d8880d4aa5e01ada992c66b7
SHA1 hash: 4645d187258549a20d030666322a93ad7cbc4974
MD5 hash: 000e67165c777f9deb1a335fe7c640a2
humanhash: five-oranges-alaska-ten
File name:DHL00118309028PDF.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:681'984 bytes
First seen:2020-05-06 06:40:08 UTC
Last seen:2020-05-11 20:50:19 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:aooIDnuKX3Ky1DZIO0VdqNI9oGsYLyKNac8awiP8Um:Znuy1th6jNsS/83n
TLSH 51E4129C761032DECC5B8532DEA42D709A663A6AC32B5A07F21F456DAB0F513DF443B2
Reporter cocaman
Tags:AgentTesla COVID-19 iso


Avatar
cocaman
Malicious email
From: DHL EXPRESS LIEFERUNG <luis.caceres@dhl.com>
Received: from linux1.delaweb.net (linux1.delaweb.net [213.192.239.60])
Date: Wed, 06 May 2020 07:39:36 +0100
Subject: DB_DHL_AWB_00117390021/AD
Attachment: DHL00118309028PDF.iso

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EJYY.8348.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 05:57:22 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sk7igad2rihrpy74hgpwjrfya4um77bexyehl77o7ya5sqbeoubq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 92be83007a8a0f17e3fc399f64c4b80728cffc24be0875ffeefe01d940247503

(this sample)

AgentTesla

Executable exe c901b6665268a9f5eeaa9e29c8fe5b9fbacbdce09be63191fc137ce573898fe7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c901b6665268a9f5eeaa9e29c8fe5b9fbacbdce09be63191fc137ce573898fe7

Comments