MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 dbc9d1ecdbb9b676ec3cfee19c21257b632962ab7cab0c7358a0e8f14ef28e53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 5
| SHA256 hash: | dbc9d1ecdbb9b676ec3cfee19c21257b632962ab7cab0c7358a0e8f14ef28e53 |
|---|---|
| SHA3-384 hash: | de85e2a57a535021d5ec80a2aea82de84b86358a9c587cf50275de599cf2cc3d750fd2f682e87e97c656f0b62526e9cc |
| SHA1 hash: | a22acd62b12924f44ec71b9217cb754b45fffe91 |
| MD5 hash: | 3cc778eae4bd3e02149c85bc3a6a5010 |
| humanhash: | mississippi-connecticut-comet-magnesium |
| File name: | 1_STMT_220602DLY639506_020622120819.ARJ |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 501'680 bytes |
| First seen: | 2022-06-03 06:04:31 UTC |
| Last seen: | Never |
| File type: | arj |
| MIME type: | application/x-rar |
| ssdeep | 12288:J9ElFez7GAWZFZCCL9QFMlzyfOcmzCX7dW8:zhgZ/5QFMJyfOcCCXY8 |
| TLSH | T158B4235E52897F76452E227AEFF451F10E497A3B2180DEECD0761C2AC2E005EDDB0A67 |
| TrID | 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1) |
| Reporter |  cocaman |
| Tags: | AgentTesla arj |
cocaman
Malicious email (T1566.001)From: ""IFB Group Ltd" <bzxiong@hk-sk.com>" (likely spoofed)
Received: "from hk-sk.com (unknown [185.222.57.182]) "
Date: "02 Jun 2022 14:43:35 +0200"
Subject: "=?UTF-8?B?UmU6IElGQkcgUGF5bWVudCBJbnN0cnVjdGlvbiBOLsK6IDczNzM=?="
Attachment: "1_STMT_220602DLY639506_020622120819.ARJ"
Intelligence
File Origin
# of uploads :
1
# of downloads :
292
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-06-02 03:02:40 UTC
File Type:
Binary (Archive)
Extracted files:
32
AV detection:
20 of 40 (50.00%)
Threat level:
5/5
Detection(s):
Malicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
AgentTesla
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.