MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dfb0665588b9a1b57e1c4d7f2a899b5a5ad9ee9c12414d2da8b77d66aa6ad62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6dfb0665588b9a1b57e1c4d7f2a899b5a5ad9ee9c12414d2da8b77d66aa6ad62
SHA3-384 hash: 6d95aea7f4709b895317cffccb5ea62c75d93ad976288024e2ac82b137e95f9614335dc2c9f916d5b7214c720096400b
SHA1 hash: 2be913ae92d2a86ad0907e6332a9e8ab0df183ec
MD5 hash: 18d84f46e40fc8075fdd9804d6f86d74
humanhash: oregon-stairway-helium-whiskey
File name:Original Shipping Documents_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:609'243 bytes
First seen:2020-06-29 11:44:12 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:sLCNduJmhoe4rFZQmQnv+jwnIP3zx8rm0wCAUqZIrZbigJmt:8CNduJmhoe4rFZknAtaPlugwt
TLSH 3FD423B09526C41F3E47878AC667C2D7EF84D3610A5AEB3FD85268CF8931D39668065C
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vmh18397.hosting24.com.au
Sending IP: 103.237.108.115
From: DHL EXPRESS <worldwide@dhl.com>
Subject: Parcel Held At Our Facility (Arrival Notice)!!
Attachment: Original Shipping Documents_pdf.gz (contains "Original Shipping Documents_pdf.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Smdd-6956905-0
Create hunting rule

PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6dfb0665588b9a1b57e1c4d7f2a899b5a5ad9ee9c12414d2da8b77d66aa6ad62/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 11:46:05 UTC
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nx5qmzkyronbwv7bytl7fkezwws23hxjyesbjuw2rn35m2vgvvra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 6dfb0665588b9a1b57e1c4d7f2a899b5a5ad9ee9c12414d2da8b77d66aa6ad62

(this sample)

AgentTesla

Executable exe 28f4c1738d5f9ed88b07a8266e674c22abb35e74bca8dc3fa6f1679f14f2a43f

  
Dropping
MD5 bbc4f9c1a8017745bdbeaa091181102d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 28f4c1738d5f9ed88b07a8266e674c22abb35e74bca8dc3fa6f1679f14f2a43f

Comments