MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2febaf591981d270f682bafb0d233d93cf9372a865f8c471dd28bc0c0751dc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2febaf591981d270f682bafb0d233d93cf9372a865f8c471dd28bc0c0751dc9
SHA3-384 hash: b7f59f3d0b56c8732322e9c8f741bb6f4436246e68c975fc76f8decd3e54c5da934ae09de26106dc12ee4978febde02f
SHA1 hash: c3ffb5805842df494d7c05e65664e1c43e3749df
MD5 hash: af0a3fc91c710f29b857bec4063dffb8
humanhash: kentucky-johnny-skylark-uncle
File name:AWB-805670003.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:728'921 bytes
First seen:2020-11-12 07:39:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:TFPkhAd/C4pxig+FGpr+CDlSqs3VbgxXiKjaVRsMxqOo9p4lXvAXRHEIU/5U:BkhAJ3XoOgFbASKjanO4lXIX5U/5U
TLSH 9CF43349C75F961D53953C16E4B926D4F226AA2C4AF38248FF12244F97235BF04B327E
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Express <zollservice.import.at@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [172.93.201.220]) "
Date: "11 Nov 2020 22:43:17 -0800"
Subject: "Shipping documents and BL and Inv"
Attachment: "AWB-805670003.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.15472.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2febaf591981d270f682bafb0d233d93cf9372a865f8c471dd28bc0c0751dc9/
Threat name:
Win32.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 05:05:09 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6l7lv5mrtaosod3ifox3burt3e6psnzkqzpyyry52kf4bqdvdxeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f2febaf591981d270f682bafb0d233d93cf9372a865f8c471dd28bc0c0751dc9

(this sample)

AgentTesla

Executable exe 07724738dcb86f8bbcb08246ffd05e44bca0fd761f28d5a1eada30851871cc31

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 07724738dcb86f8bbcb08246ffd05e44bca0fd761f28d5a1eada30851871cc31
  
Dropping
AgentTesla

Comments