MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f286c31f151835f053d4981ceb67322775ed770e685ad2a3f7e470a31f6fb76d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f286c31f151835f053d4981ceb67322775ed770e685ad2a3f7e470a31f6fb76d
SHA3-384 hash: 36207a88753b0f643e2ddf67e4edf0b4d18b640262d20eeedb0bb666bafac9ea033ac82c7fc7d77f0261da95d4e0f262
SHA1 hash: a16ca3ff2d48044f29a08c48d6ed5efe37d68992
MD5 hash: 7561156a9aaa9d7431456a0100cbd024
humanhash: hydrogen-nevada-ohio-jig
File name:DHL_AWB.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'308 bytes
First seen:2020-05-09 17:49:29 UTC
Last seen:2020-05-10 06:27:39 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:S9juV8TPPftSn4i32jD/pVP+KTWQi00Fkaq++m:S9Pbte4D/fiQiFK++m
TLSH 9C9423C28CC5D329E09030A9F035452B777C9156BA33057F6A324872779EAB369E86FD
Reporter abuse_ch
Tags:AgentTesla DHL z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.pickelhost.com
Sending IP: 103.114.106.29
From: Mandy Chau (DHL HK) <mandy.chau@dhl.com>
Subject: DHL Global Forwarding (China) Co., Ltd. CARGO RECEIPT, INVOICE AVAILABILITY NOTIFICATION: 200507473
Attachment: DHL_AWB.Z (contains "DHL_AWB.exe")

AgentTesla SMTP exfil server:
mail.advoicemediaworks.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-09 18:35:28 UTC
File Type:
Binary (Archive)
Extracted files:
66
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kdmghyvda27au6utaoowzzse52625yonbnnfi7x4rykgh3pw5wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z f286c31f151835f053d4981ceb67322775ed770e685ad2a3f7e470a31f6fb76d

(this sample)

AgentTesla

Executable exe 3c6f85f19f86f64fe7dba24594186dbd3365bd756bf97411f9270ac538896aaf

  
Dropping
MD5 40b7c24bc80d6b43141fe82eeafb368d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c6f85f19f86f64fe7dba24594186dbd3365bd756bf97411f9270ac538896aaf

Comments