MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3241d3e58071c903d635550d9dd35da14d3602a349c716527e4a9f147b7e4be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3241d3e58071c903d635550d9dd35da14d3602a349c716527e4a9f147b7e4be
SHA3-384 hash: d62d24e8162953631056c008d655d0bf0c3350a9de8a1dd464540cf3a97741a624a6b8cbb6f47992d37faf85b02e6956
SHA1 hash: 51957aed1487e1de44e8909fc71a37984b660567
MD5 hash: 6e2ca33938e2f1bb46353374835dd309
humanhash: blossom-pizza-delaware-delaware
File name:DHL_Telex Release BL.tar.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'019'904 bytes
First seen:2021-05-12 05:48:17 UTC
Last seen:2021-05-12 07:01:00 UTC
File type: tar
MIME type:application/x-tar
ssdeep 24576:jWoLAlffQ/jDT3AcMUHKVK3UuZyQo15nMMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMH:aQLDL3HCjYh+MMMMMMMMMMMuMMMMMMMP
TLSH AE257CA8B14064F9C65B5C3367CFDC3542102EB4A52B551A67E03FBF39BBD232A38589
Reporter cocaman
Tags:001 AgentTesla DHL


Avatar
cocaman
Malicious email (T1566.001)
From: ""KeJia Cai (NAH CLR)(DHL CN)"< cai.kejia@dhl.com >" (likely spoofed)
Received: "from dhl.com (unknown [103.139.44.91]) "
Date: "11 May 2021 10:04:24 -0700"
Subject: "Fw: AW: DHL Telex release BL of sea shipemment"
Attachment: "DHL_Telex Release BL.tar.001"

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.11672.14598.17283.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3241d3e58071c903d635550d9dd35da14d3602a349c716527e4a9f147b7e4be/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-05-11 22:15:06 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
17 of 47 (36.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ymsb2psya4ojapldkvintxjv3ikngybkgsohczjh4su7cr5x4s7a._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210512-87kp6sxtae/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3241d3e58071c903d635550d9dd35da14d3602a349c716527e4a9f147b7e4be

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

tar c3241d3e58071c903d635550d9dd35da14d3602a349c716527e4a9f147b7e4be

(this sample)

AgentTesla

Executable exe 88b8288d3eb53f6694cc7cf0ed23b668f04c8701ad529210bb0c4d9cd2feb0b4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 88b8288d3eb53f6694cc7cf0ed23b668f04c8701ad529210bb0c4d9cd2feb0b4
  
Dropping
AgentTesla

Comments