MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4113e8b2de1f7b257d0bd6a4233482dec4f26964cd48ff1b4180b7000ba1c18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4113e8b2de1f7b257d0bd6a4233482dec4f26964cd48ff1b4180b7000ba1c18
SHA3-384 hash: 140962f0f4884e4e5552582bd734d0adc45fcf72597954d268bb676acc07870367a23edcc387d082f9f7e2f746a2172f
SHA1 hash: 55029a903cd533b2b41d72fbc6fefd9b51d9713e
MD5 hash: 76d3be66abdbfc7ae54e56170d86bf25
humanhash: utah-fillet-william-jersey
File name:DHL_DOCUMENT7348255141_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:517'470 bytes
First seen:2020-05-21 10:14:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:FYtMXJa90ohvlm7eEhGTvVeEGgcKAKbB3reVBvNAVT0kZ5BX6nfSRhTa13XDV2HT:O90oBS9GTvDUUBXT0kwnQuTMQEGxKP
TLSH 39B4235B9B861E74AF5647464722AE77033DE68C75662CE2D2F6036EC0DC84CC1D8E3A
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 45-138-132-30.derakhshanrah.com
Sending IP: 45.138.132.30
From: DHL EXPRESS <CUSTOMERSERVICE@DHL.COM>
Reply-To: DHL EXPRESS <soomla6384@yahoo.com>
Subject: DHL Shipment Notification : 950308272773
Attachment: DHL_DOCUMENT7348255141_pdf.rar (contains "DHL_DOCUMENT7348255141_pdf.exe")

AgentTesla SMTP exfil server:
premium80.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 10:37:12 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yqit5czn4h33ev6qxvveem2ifxwe6juwjtki74nudafxaaf2dqma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c4113e8b2de1f7b257d0bd6a4233482dec4f26964cd48ff1b4180b7000ba1c18

(this sample)

AgentTesla

Executable exe b18e468d90e6b3495f9a7b250b0476305950b14015dcf54dba6d3723738f09ad

  
Dropping
MD5 19b7d3d22d3ac886782466df68955f9b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b18e468d90e6b3495f9a7b250b0476305950b14015dcf54dba6d3723738f09ad

Comments