MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc6423302f5bb16313b3eb2baef1fb64da923b750c3b7e39d848953140288234. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc6423302f5bb16313b3eb2baef1fb64da923b750c3b7e39d848953140288234
SHA3-384 hash: f3d512ad15aa4049b7824321e2aca9f9eb4d5aa24f79f1f9e6cf92be16b5e6cf8ec4f0e1d44ee93929a226fa6ff07523
SHA1 hash: 0aa2a0241a8010e3ec0700adbc103606ad5199cb
MD5 hash: b14c4a6d325da83c80a4626c3c8f7161
humanhash: august-nuts-lamp-vegan
File name:BL 204103842.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'758 bytes
First seen:2021-01-26 06:42:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:bYRq70IypIF857jtWobjjm7VuPZwAh3OaDC9EbPk:bYk7DoLeVA3OaDC9EA
TLSH 82A42302159BB860024764BAD3E729CB7A70B54F050529D260DF7776B03B63AEE26F3C
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Dina Hossam <dina.hossam@dhl.com>" (likely spoofed)
Received: "from box.dertysm.xyz (box.dertysm.xyz [134.122.14.245]) "
Date: "Mon, 25 Jan 2021 18:40:17 -0600"
Subject: "AWB Copy ,6020154744"
Attachment: "BL 204103842.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.24920.28561.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc6423302f5bb16313b3eb2baef1fb64da923b750c3b7e39d848953140288234/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-26 03:59:50 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3rscgmbploywge5t5mv254p3mtnjeo3vbq5x4ooyjcktcqbiqi2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dc6423302f5bb16313b3eb2baef1fb64da923b750c3b7e39d848953140288234

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar dc6423302f5bb16313b3eb2baef1fb64da923b750c3b7e39d848953140288234

(this sample)

AgentTesla

Executable exe 3c8032ddd2f77a14862946d88ec94bff2d42ea6b4cf59ac2942327f275a2a298

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c8032ddd2f77a14862946d88ec94bff2d42ea6b4cf59ac2942327f275a2a298
  
Dropping
AgentTesla

Comments