MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b98bd1a133eb23807f5dbb35039c2baba66f732254cb323559c58c0f72f14f3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 4
| SHA256 hash: | b98bd1a133eb23807f5dbb35039c2baba66f732254cb323559c58c0f72f14f3c |
|---|---|
| SHA3-384 hash: | a9dd0cab8aa47ba734627e116c2eebb4a79bbc1b9f14da14c61cdee95f40603fc673e60112b2e8cfd64bce67428a4362 |
| SHA1 hash: | 94bef54d643c0045fbaa78ff0302234c87a3c9da |
| MD5 hash: | 9d3f16f26ec4a188f9a5d0dc043bad9d |
| humanhash: | echo-princess-ack-violet |
| File name: | AWB 673687387578.rar |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 787'386 bytes |
| First seen: | 2021-02-04 06:24:33 UTC |
| Last seen: | Never |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 24576:Txr7Mxa2wJhM9scFN6TlWkMbO/3WORjGtOSrip5S6T9:TpMIJy9zPrkMbO/dj0onJ |
| TLSH | 23F42362B2C9238EB2F8B577F660DB2768CD5F4E6C21B19111C48BF870B086B7275356 |
| Reporter |  cocaman |
| Tags: | AgentTesla rar |
cocaman
Malicious email (T1566.001)From: "Thulasi M <dgf.sg.payableinvoices@dhl.com>" (likely spoofed)
Received: "from box.herdaser.xyz (box.herdaser.xyz [167.172.136.87]) "
Date: "Wed, 03 Feb 2021 18:32:20 -0600"
Subject: "RE: Longstanding Container(s) : 204103842"
Attachment: "AWB 673687387578.rar"
Intelligence
File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-02-04 06:25:06 UTC
File Type:
Binary (Archive)
Extracted files:
37
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
AgentTesla
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.