MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c8367b6f8257962cc0802a33628d684d7213d795cf9027a6fe7cb7d69b5ac6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c8367b6f8257962cc0802a33628d684d7213d795cf9027a6fe7cb7d69b5ac6e
SHA3-384 hash: 3e83665d02765130ba7feb635ae09757550fd51fe896773f447fa71b81f287a9998e3a47a794f083cc95aea13b7667f0
SHA1 hash: 831d08ddbae160a81e7d6e07f3299956e508399d
MD5 hash: a9703d0f9c6861790416b92a7f8eaf4a
humanhash: red-cold-kansas-cardinal
File name:DHL_FORM-00987635647PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:322'049 bytes
First seen:2020-07-21 14:06:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:TcrgQ/vKe5IGWqO4L8mSDpruuAnkHIu9qpZz0t0Inkomv9hcPU5lbS2CHnOc:vQ/vKeK+8dDankou9Makjrz5lG2CT
TLSH 7E64234450CBF2F3EB35F697F8376B82A7C00B28B6B9DA2949D58AD0917504547D06F8
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: strops.lnvm.eu
Sending IP: 84.237.244.181
From: ENVÍO EXPRESS DE DHL <dhlSender@dhl.com>
Subject: DB_DHL_AWB_00117390021/AD
Attachment: DHL_FORM-00987635647PDF.rar (contains "DHL_FORM-00987635647PDF.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c8367b6f8257962cc0802a33628d684d7213d795cf9027a6fe7cb7d69b5ac6e/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 14:07:06 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fsbwpnxyev4wftaiakrtmkgwqtlscplzlt4qe6tp47fx22nvvrxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c8367b6f8257962cc0802a33628d684d7213d795cf9027a6fe7cb7d69b5ac6e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2c8367b6f8257962cc0802a33628d684d7213d795cf9027a6fe7cb7d69b5ac6e

(this sample)

AgentTesla

Executable exe 02edda3edc65e304b70cd65a76ded7188ef03b402b16903f2d8f9fb55dd45e0e

  
Dropping
MD5 29ee52849603cf98bada0c34838bd972
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 02edda3edc65e304b70cd65a76ded7188ef03b402b16903f2d8f9fb55dd45e0e

Comments