MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f03474970648d26e2492416b3c36bb38830ba5d20455f79bda4ff81a5ed7069. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f03474970648d26e2492416b3c36bb38830ba5d20455f79bda4ff81a5ed7069
SHA3-384 hash: ad890455fb7204af19f9d79099d009e28e6400cd582e15de18b4a81025e72fe1e5dff9b6261151ef0d7f1c6b98311769
SHA1 hash: fcb0e1d83122dda4a5e71d0b44d9790f8ae0e291
MD5 hash: bffa6c3af50f0b15847be0695b6a1238
humanhash: victor-delaware-burger-early
File name:INVOICE COPIES, SHIPPING DOCUMENTS BL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'094 bytes
First seen:2020-05-22 07:15:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:F6hrRZN52UjVUJCp6KZhKMDgqtLfThQaV:d6NHlEqtRV
TLSH AC84232500FBDC91616291D93E8B658D280F7FE06E15D2F4831A3AA5262B064F5ADFFC
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 185.94.191.45
From: DHL Express Delivery <expressdelivery@dhl.com>
Reply-To: DHL Express - Felix Muller <felixmuller.dhl@mail.com>
Subject: Fw: NEW SHIPMENT NOTIFICATION: INVOICE COPIES, SHIPPING DOCUMENTS & BL; AWB NUMBER - 426129487
Attachment: INVOICE COPIES, SHIPPING DOCUMENTS BL.rar (contains "INVOICE COPIES, SHIPPING DOCUMENTS & BL.exe")

AgentTesla SMTP exfil server:
mail.alvadiwipa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:36:43 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
17 of 30 (56.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5f03474970648d26e2492416b3c36bb38830ba5d20455f79bda4ff81a5ed7069

(this sample)

AgentTesla

Executable exe 8efa8505066ee4c366657eb07b866e7493dffd71a6c4626c811dd25e15b45828

  
Dropping
MD5 136b2a4cc6e7fca4276bc903638511a8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8efa8505066ee4c366657eb07b866e7493dffd71a6c4626c811dd25e15b45828

Comments