MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c3fdf0624a4ada178cf11a7d417a80593c83b2a757a11bc4ab8cdd272f8677e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c3fdf0624a4ada178cf11a7d417a80593c83b2a757a11bc4ab8cdd272f8677e
SHA3-384 hash: 574b7a9ac92b96e6a5ef6886ece644ce36305285ae6490fdabdbfddfed0c95015aa4ad30592070ea4dce9b72ecc53415
SHA1 hash: 9f3cfa0d30e3777c525d3c18708ceefb06e1af09
MD5 hash: bca05333907412823e79ebff3b0d1261
humanhash: early-kansas-uranus-low
File name:ORIGINAL SHIPPING DOCUMENT.r09
Download: download sample
Signature AgentTesla
Create hunting rule
File size:413'354 bytes
First seen:2020-07-07 09:33:13 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 6144:LjIXzAdZ6jWSC1C6cVJrSJP6mJhAQCIMstirdBj031zbnolYvoHO:LjWsr61gCJJmJPvzAhstirfeNslYou
TLSH 6E942358C7C3B6D337C9327A8DDE1F1A6386376278F6014305CCEB1DDAE58766A1A910
Reporter abuse_ch
Tags:AgentTesla DHL r09


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: v234004.serveradd.com
Sending IP: 103.15.234.4
From: DHL Express <sales@mailgoesbulkworld.live>
Subject: FWD: DHL Shipment Notification Ref ID: 44633179800
Attachment: ORIGINAL SHIPPING DOCUMENT.r09 (contains "ORIGINAL SHIPPING DOCUMENT.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c3fdf0624a4ada178cf11a7d417a80593c83b2a757a11bc4ab8cdd272f8677e/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:35:05 UTC
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lq756breusw2c6gpcgt5if5iawj4qozkov5bdpckxdg5e4xym57a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 5c3fdf0624a4ada178cf11a7d417a80593c83b2a757a11bc4ab8cdd272f8677e

(this sample)

AgentTesla

Executable exe 954171c43ee36bd140f210f717cfd680607c10d761a425e5a7306fc28c983d2a

  
Dropping
MD5 8303e2f205ff8f2c024cd640e49a19a4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 954171c43ee36bd140f210f717cfd680607c10d761a425e5a7306fc28c983d2a

Comments