MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e28ad452dbd7310d0a99b9d0ac6f255fc395c1ad3b83fdc48582407bf6f01b6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e28ad452dbd7310d0a99b9d0ac6f255fc395c1ad3b83fdc48582407bf6f01b6c
SHA3-384 hash: 3008a1f376bc661d8abe577c14aa16a5c99a2123d5e38836afb25c918c2154b863fb394a17d996780334973aa1cf5fde
SHA1 hash: d0700d1b1dfe50581316e11f46e46c0dc41c1988
MD5 hash: eb5114d24726ffba76684ef244073626
humanhash: thirteen-fifteen-robin-fourteen
File name:DOC-INV8363753.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-04 21:24:23 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:5gtcKf9mCf21S3ev9dDSlaFCdbjkZUrXSw3P:8cKFmy21ceFpS0AdbjSUDSwf
TLSH 484512917A018073E663493600B66B04C7DBFE6A94B2B06F774CBA147FB62D3456BCC2
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.postservicedelevery.co.uk
Sending IP: 192.119.117.126
From: DHL Global Mail Inc © <ysld@postservicedelevery.co.uk>
Subject: Access Your DHL invoices AWB Number: 83630000
Attachment: DOC-INV8363753.IMG (contains "DOC-INV8363753.exe")

AgentTesla SMTP exfil server:
mail.gumarabic.sd:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.UGA.20041.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 09:26:24 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4kfniuw324yq2cuzxhiky3zfl7bzlqnnhob73refqjahx5xqdnwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img e28ad452dbd7310d0a99b9d0ac6f255fc395c1ad3b83fdc48582407bf6f01b6c

(this sample)

AgentTesla

Executable exe 07a313a7a49c4b8c0fafa65f3779a32ffa3f8cd52073fc38a657189839b91668

  
Dropping
MD5 5054e2111dfa29f56a920d08db037b6d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 07a313a7a49c4b8c0fafa65f3779a32ffa3f8cd52073fc38a657189839b91668

Comments