MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9f77037d06eb2f477114834e9fd04804127c2729d11f9abd2cc201ef38891d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9f77037d06eb2f477114834e9fd04804127c2729d11f9abd2cc201ef38891d5
SHA3-384 hash: f5ad8c70d9a8c8554a83ad5b2d3e30923e371190a7aa78c6ad93a700e532414e394da87ea281449640f57dab64eccb9e
SHA1 hash: 34add77cd6c5742ac947db3c51d760e639e8aee7
MD5 hash: 82656d273f2e3fc1a8c8ed08254757ba
humanhash: pluto-mike-arizona-carbon
File name:DHL ontvangstbewijs 8897209547, pdf.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:753'664 bytes
First seen:2020-05-19 09:51:53 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:9Ys1kF2Ax/GKnqnXMfbxes9ZnBVgN+m0J+XWd6b2o3BjEg/LgrwVH:9YgCy0qkH7zIiJ+XW+2o3Bjn/LgsV
TLSH 45F4BF26F290C833C163253D9C1F9668D92ABE613E3859763FEC1D4C9F397813926297
Reporter abuse_ch
Tags:AgentTesla DHL geo iso NLD


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.inebenthe.com
Sending IP: 45.95.169.158
From: DHL Express Cargo <delivery@dhl.com>
Subject: Vrachtbezorging DHL
Attachment: DHL ontvangstbewijs 8897209547, pdf.iso (contains "DHL ontvangstbewijs 8897209547, pdf.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 10:35:50 UTC
File Type:
Binary (Archive)
Extracted files:
266
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7h3xan6qn2zpi5yrja2ot7ieqbaspqtstui7tk6szqqb544ishkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso f9f77037d06eb2f477114834e9fd04804127c2729d11f9abd2cc201ef38891d5

(this sample)

AgentTesla

Executable exe 91460c91d05256b76b68f3f1167e085e9a1f7dfcbe6bb2e89eeca610d7cb0d83

  
Dropping
MD5 228b7ff45b879d096a442f848b2fa2ff
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91460c91d05256b76b68f3f1167e085e9a1f7dfcbe6bb2e89eeca610d7cb0d83

Comments