MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1b824fe6dc036efb645e7223db17477b60c4aa5e7ac6cc056bcf056326b1ac9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1b824fe6dc036efb645e7223db17477b60c4aa5e7ac6cc056bcf056326b1ac9
SHA3-384 hash: 551ef98368b968061c11ea000cd17b9fcfa30d47f8d2ffb858e8f618d89ecc51ec2ce087f208aab7c953b8739d0b8491
SHA1 hash: 939787f732805c38cb167c893d69c7fa3e912629
MD5 hash: 2e789e11cbe98d591c9aaf8a44b7544b
humanhash: sink-river-potato-single
File name:REVISED ART WORK AND LABELS WITH FULL DETAILS FOR FIRST 10FCL SHIPMENTS .rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:282'486 bytes
First seen:2020-07-29 09:39:29 UTC
Last seen:2020-07-29 09:40:07 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:QvhY+vhJHkY7jL84JRCR/GCHPfxNmuU7+RKaKsOxz+:mhlvhZxfUGSz5RKa7
TLSH 12542365DCE53741373FABAA624665E38BA11D76B6EDC340C72BC025E0D8807D06D2FA
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email
From: "Rafael, Escudero" <rafael@globalline.org>
Received: from box.globalline.org (box.globalline.org [46.101.238.248])
Date: Wed, 29 Jul 2020 02:16:52 -0700
Subject: shipping logo
Attachment: REVISED ART WORK AND LABELS WITH FULL DETAILS FOR FIRST 10FCL SHIPMENTS .rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1b824fe6dc036efb645e7223db17477b60c4aa5e7ac6cc056bcf056326b1ac9/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 09:41:04 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2g4cj7tnya3o7nsf44rd3mluo63aysvf46wgzqcwxtyfmmtldleq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d1b824fe6dc036efb645e7223db17477b60c4aa5e7ac6cc056bcf056326b1ac9

(this sample)

AgentTesla

Executable exe ec7341298210fae2e147d0ed6b9f9cf9edfd87d7e3901083ac4ab7c7d98519ba

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec7341298210fae2e147d0ed6b9f9cf9edfd87d7e3901083ac4ab7c7d98519ba

Comments