MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e0ba10da09e2a6e5befa224871679f8c59e50c9775cba738762524e1805b4c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e0ba10da09e2a6e5befa224871679f8c59e50c9775cba738762524e1805b4c8
SHA3-384 hash: 296b2cca626b4315f9f1bc802c2adcc235ebe0cf832ade7c79be2702a0f666244e66ea73349aa107a47fc245a64ecad6
SHA1 hash: cff7919c5a81aab926382eeb9ce297c288b57f5e
MD5 hash: 08bd4330835edc97effa3694252f1c0b
humanhash: whiskey-carpet-cardinal-neptune
File name:Invoice Copies, Original Shipping documents, and BL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:838'348 bytes
First seen:2020-05-29 05:59:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:QFRcuPUBZ4dprPkiGLTMx6nljMNjHZn3XFRcuPUBZ4dprPkiGLTMx6nljMNjHZnU:4Rr1uHMxAMNjZFRr1uHMxAMNjZU
TLSH 710523ECE4794B440DA496F5637863DB529BC3EDF1021CFA8843D2305D98EE42A9D6BC
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 37.72.175.158
From: DHL Express Delivery <expressdelivery@dhl.com>
Reply-To: DHL Express Delivery <expressdelivery@dhl.com>
Subject: Fw: NEW SHIPMENT NOTIFICATION: INVOICE COPIES, SHIPPING DOCUMENTS & BL; AWB NUMBER - 5848449052
Attachment: Invoice Copies, Original Shipping documents, and BL.rar (contains "Full set of shipping Documents.exe")

AgentTesla SMTP exfil server:
mail.ideeforce.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 06:36:34 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2e0ba10da09e2a6e5befa224871679f8c59e50c9775cba738762524e1805b4c8

(this sample)

AgentTesla

Executable exe 2d087f692712048cacf9fd659710e3c0d4916827fdbfc1a8a5b2a50ac4218920

  
Dropping
MD5 10723f65c8c0201084c8ac5eda722be2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2d087f692712048cacf9fd659710e3c0d4916827fdbfc1a8a5b2a50ac4218920

Comments