MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 501b5fbfddf71eae178b41f85000e32478692e6224db3369668deca8ff5e48bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 501b5fbfddf71eae178b41f85000e32478692e6224db3369668deca8ff5e48bf
SHA3-384 hash: b33456dc9fe416c4b20f1f3eb9820cd9e39ab359507c7d044bb2506353c2a071946f5cf3fa05fd9a6835fa9fe3e1d61e
SHA1 hash: 8bd14af14695c293228732f15bd463adc12905fa
MD5 hash: 684294448a3e0f363f047a238e422dc2
humanhash: delaware-potato-wisconsin-wolfram
File name:Original Shipping documents.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:527'723 bytes
First seen:2020-07-10 17:40:26 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:iJG88DJelY20s4C84DQYW9TT+2kka4TSlI0VIeUEAN4y1:5xb2VI4DQDTT+R34TSlFNTy1
TLSH 1CB4234825DD771F819D7A36A1A8E310DD5A140906C7EA7303E89DE025BFDBCB039E6E
Reporter abuse_ch
Tags:AgentTesla DHL z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 37.49.230.212
From: DHL EXPRESS <ODD@dhl.com>
Subject: DHL-Notification: You have a parcel.
Attachment: Original Shipping documents.Z (contains "Original Shipping documents.exe")

AgentTesla SMTP exfil server:
mail.threewaystoharems.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/501b5fbfddf71eae178b41f85000e32478692e6224db3369668deca8ff5e48bf/
Threat name:
ByteCode-MSIL.Hacktool.Mimikatz
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 17:42:06 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kanv7p6564pk4f4lih4faahder4gsltcetntg2lgrxwkr726jc7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 501b5fbfddf71eae178b41f85000e32478692e6224db3369668deca8ff5e48bf

(this sample)

AgentTesla

Executable exe bc02ccc2308126e2b656f8ab033d7c0e188873aa42eb103e8cdf631ae6e36449

  
Dropping
MD5 0d7eb830d496b29d26fdff1c5223d379
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bc02ccc2308126e2b656f8ab033d7c0e188873aa42eb103e8cdf631ae6e36449

Comments