MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c16f0fc159937c8705a37fb077b20db87efc793e985e80331ee3991b4e707577. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 5
| SHA256 hash: | c16f0fc159937c8705a37fb077b20db87efc793e985e80331ee3991b4e707577 |
|---|---|
| SHA3-384 hash: | a67b86294a6e1801fab11791d082b89fef041d157ddaeae7592f2d295a10dff2d1422a4b9826eed285a5d2a441089183 |
| SHA1 hash: | 1a0a0654a2137c8297a6b7a292b0d304006a9563 |
| MD5 hash: | 0a0c96772745d973f85fdec3d5e2ccc3 |
| humanhash: | fruit-bluebird-pizza-fifteen |
| File name: | Shipping Docs_Original BL, Invoice & Packing List.zip |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 579'135 bytes |
| First seen: | 2021-03-10 16:48:43 UTC |
| Last seen: | 2021-03-29 13:43:53 UTC |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 12288:gfhTonQ9spVLJjmwehNjzaQ31PA/EFIDmBnNYtX3h7nX7F+:g1oQ9sDLJAbjzaQlbYf7X70 |
| TLSH | A8C42302F1E0E66BC4849689EC61BD845D33D75F1BB499226D20C681EAFB073DF7668C |
| Reporter |  cocaman |
| Tags: | AgentTesla DHL INVOICE zip |
cocaman
Malicious email (T1566.001)From: "DHL | Global Forwarding <dispatch@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [217.146.81.124]) "
Date: "10 Mar 2021 16:24:46 +0100"
Subject: "RE: Telex Release - B/L PZU100002800 - lgpartner.ch"
Attachment: "Shipping Docs_Original BL, Invoice & Packing List.zip"
Intelligence
File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Status:
Malicious
First seen:
2021-03-10 16:49:05 UTC
File Type:
Binary (Archive)
Extracted files:
114
AV detection:
13 of 47 (27.66%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
AgentTesla
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.