MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 039dd20d36147e9a5999ca3fcca1aa51e3170db72af4d567c80263c9539e79f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 039dd20d36147e9a5999ca3fcca1aa51e3170db72af4d567c80263c9539e79f3
SHA3-384 hash: ce838ebd47a7e6e87493d35fdd5e91657bd7d18d6c301dec6abcdaa9fa890e8c3bc09b33b7bf42bf2e8a2ad89c83a49b
SHA1 hash: e51159dbefb8f546c36d3c703d5eba1dfb57758a
MD5 hash: 8011708e95b2024f72e3cbba3ff14fc3
humanhash: may-oklahoma-carpet-coffee
File name:DHL_AWB 1008936572891_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:323'501 bytes
First seen:2020-08-13 14:17:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:dlFgDjj+UH8aTd758CKotrh9iFSdtEQCrNCd01K4HhSSQRGj2jUj:DFgDGUHVplxKGrfiFSdtEFW0x9
TLSH DD6422F416F54899F7FBD01E30A9947FA088FEF4C05C191E99D923B2AB92059D80176F
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: de.uitn.com
Sending IP: 144.76.245.34
From: DHL EXPRESS <CUSTOMERSERVICE@DHL.COM>
Reply-To: DHL EXPRESS <soomla6384@yahoo.com>
Subject: Ref: DHL_AWB #1008936572891
Attachment: DHL_AWB 1008936572891_pdf.rar (contains "DHL_AWB #1008936572891_pdf.exe")

AgentTesla SMTP exfil server:
mail.specialmetal.ir:587

AgentTesal SMTP exfil email address:
info@specialmetal.ir

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/039dd20d36147e9a5999ca3fcca1aa51e3170db72af4d567c80263c9539e79f3/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 14:19:08 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aoo5edjwcr7juwmzzi74zinkkhrrodnxfl2nkz6iajr4su46phzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/039dd20d36147e9a5999ca3fcca1aa51e3170db72af4d567c80263c9539e79f3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 039dd20d36147e9a5999ca3fcca1aa51e3170db72af4d567c80263c9539e79f3

(this sample)

AgentTesla

Executable exe 630667a466b8fa4783cd9921551834f41a9e3a40712cda832dc2faf61503c00f

  
Dropping
MD5 243146d687254351cbb37111a36bbade
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 630667a466b8fa4783cd9921551834f41a9e3a40712cda832dc2faf61503c00f

Comments