MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4dadc9d0abca019b02f860bc603d930c1e5e4b8689a89034091f1af12aaefc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4dadc9d0abca019b02f860bc603d930c1e5e4b8689a89034091f1af12aaefc0
SHA3-384 hash: cdd989567c4cf6545fd4a851d3cb4cfd5eefe982ac62f193f67fd6b67002e7621caedfaa8524e6dd8874163b7bc7b4a1
SHA1 hash: d50e51b66cef490433eded8819c3b03c966242c2
MD5 hash: b444a9bd5538da60d08a7e4534cfd827
humanhash: equal-emma-ack-blue
File name:DHL_FORM19837649PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:504'589 bytes
First seen:2020-10-16 12:41:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:TDjBsuC1LeCd0eko6CimNNzcTIJWLw0uoyNDvm40tdvsYxm2DWJLv:9suCB1kJ3mNNzcT3nuoelqvsYhsv
TLSH 77B42342582C37D20928012C2D6D76681A13D9E41D7BC7BE501EF8BABE5CD7BCE0A9B1
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: DHL EXPRESS DELIVERY <intraship@dhl.com>
Reply-To: result.box2019@mail.com
Subject: DHL DELIVERY(FAILD NOTIFICATION)
Attachment: DHL_FORM19837649PDF.rar (contains "oAE1k5FWePBcJxC.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4dadc9d0abca019b02f860bc603d930c1e5e4b8689a89034091f1af12aaefc0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 08:06:53 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2tnnzhikxsqbtmbpqyf4ma6zgda6lzfyncnisa2ashy26evk57aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d4dadc9d0abca019b02f860bc603d930c1e5e4b8689a89034091f1af12aaefc0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d4dadc9d0abca019b02f860bc603d930c1e5e4b8689a89034091f1af12aaefc0

(this sample)

AgentTesla

Executable exe 92210ff813da2d2b0ff5158a6385fff2d25cfa1c74836fe877da90a287611a49

  
Dropping
MD5 05d715c8719139260b167f85ef0701ed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92210ff813da2d2b0ff5158a6385fff2d25cfa1c74836fe877da90a287611a49

Comments