MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6d271cc3c1b1429eb814443ac80b36b27458562fc082116c0a4e7098c91ca2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6d271cc3c1b1429eb814443ac80b36b27458562fc082116c0a4e7098c91ca2f
SHA3-384 hash: 3472b0c696afd94848b06f6b76e8136aa0db1dd60ca32dc438db7435fe4ff22e23d0e854015f8139d012bd100d99bf22
SHA1 hash: 6ea8043d48aca68ee245329eed6df30f5b1eebed
MD5 hash: 5f066ef92bd32e676be4f732b4be56d4
humanhash: march-network-fish-king
File name:awb_ARRIVAL DHL EXPRESS 3245888693.tbz2
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'852 bytes
First seen:2020-06-17 10:01:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:6ynpBxlhWKRhdyc0dXeWMOPMrAfvkMu7mBMyK3yK7x+mdxG9T0xHfK6qJUc:6y5lkKROdXeuEmBCV29T0lrdc
TLSH 328423C7C58EC2BA212B07D94B5A6DEF6977003E89202BC3BACC6466CBBDE4D9543151
Reporter abuse_ch
Tags:AgentTesla DHL tbz2


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx2.aroelevenhost.com.br
Sending IP: 192.163.198.161
From: dhlemailship@dhl.com
Subject: DHL EXPRESS AWB 3245888693- Shipment Notification
Attachment: awb_ARRIVAL DHL EXPRESS 3245888693.tbz2 (contains "awb_ARRIVAL DHL EXPRESS 3245888693.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 10:37:30 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=63jhdtb4dmkct24birb2zaftnmtulblc7qeccfwauttqtderzixq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f6d271cc3c1b1429eb814443ac80b36b27458562fc082116c0a4e7098c91ca2f

(this sample)

AgentTesla

Executable exe 5e941da13defa2fe179591d06147980beecea89ec1584e5c383e18b094243657

  
Dropping
MD5 da0621dc942888abf5070f2eb2a02765
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5e941da13defa2fe179591d06147980beecea89ec1584e5c383e18b094243657

Comments