MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1745e604bd9245c5de9e8cadb0736c8649e4c0dfeb19789ad2370ec0d531dbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1745e604bd9245c5de9e8cadb0736c8649e4c0dfeb19789ad2370ec0d531dbf
SHA3-384 hash: e525d7aa738df854a15ff02df98d8a7468da38f844024a3d91cfcffee6b67ce736987a1307e49ffa06a9446852d86614
SHA1 hash: eb2c93564be1ee9e06dfebb364f94d62fbf00287
MD5 hash: f26a9da461e4020d8377694bd84b7f64
humanhash: kilo-purple-vegan-video
File name:DHL_August 2020 at 1.87_8BZ290_PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-17 17:41:41 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:Nvtjom2brNsV8jonshp+JAoJdG1n6wepRctovnTjgYvchJY1qbQML+I7NPUns:r1YRsVyoshR4g1n6pR4ofHbM1LJ71D
TLSH A5452303D0E9DDBACA26B47E50A562401330FF5F6162C99B7C8C7A39EF65B809363817
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: servermarrones.residuos.cat
Sending IP: 51.89.20.142
From: DHL Customer Support <noreply@dhl.com>
Subject: Re: DHL Notification / DHL_AWB_001179303/ ETD
Attachment: DHL_August 2020 at 1.87_8BZ290_PDF.img (contains "DHL_August 2020 at 1.87_8BZ290_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.83cc12aeb575b1b3.18287.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1745e604bd9245c5de9e8cadb0736c8649e4c0dfeb19789ad2370ec0d531dbf/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-17 08:20:39 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2f2f4ycl3esfyxpj5dfnwbzwzbsj4tan72yzpcnnenyoydktdw7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d1745e604bd9245c5de9e8cadb0736c8649e4c0dfeb19789ad2370ec0d531dbf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d1745e604bd9245c5de9e8cadb0736c8649e4c0dfeb19789ad2370ec0d531dbf

(this sample)

AgentTesla

Executable exe 2e3690d2a5638c8d077996c40c62d20e715f230c549f3c0444f9055178d0a3e3

  
Dropping
MD5 83cc12aeb575b1b33b677e8602c0d63e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e3690d2a5638c8d077996c40c62d20e715f230c549f3c0444f9055178d0a3e3

Comments