MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12353dae0a101c0468d22dddcf1bd38ffada948e1309e3e7e9faa4fd10f80261. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12353dae0a101c0468d22dddcf1bd38ffada948e1309e3e7e9faa4fd10f80261
SHA3-384 hash: 7c0fc78bee0f1f9621523b20d67ac25ad5af78ee00947900bdeebe6b71a8c3065a3ffedd9ce1257506987acac6bca92b
SHA1 hash: 69af3f4dc53c86d5b163081b3bc4e920c885f8f6
MD5 hash: f8b387e35aa2cb1fa6394b22d43dba2e
humanhash: queen-seven-ceiling-september
File name:dhl_shipment_paperwork 786432956_2020.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:456'955 bytes
First seen:2020-08-04 10:14:43 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:/qlAw6xp/+eAXy4oktYB0MYx2Kmgm0D9XE2WO21QXSEBd5wZKIIUjzm1KaaxI:rw6viLs0z2RR2NzXS4d5wFIfQlI
TLSH 9AA423794DE9331A1B84C265E251B0834FE69FBB221772DC538E223F9168F13783A85D
Reporter abuse_ch
Tags:AgentTesla DHL r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.voitabelting.com
Sending IP: 104.168.213.3
From: Customer Service Administrator (DHL ASIA) <info@voitabelting.com>
Subject: DHL Express Shipment Confirmation To gearindustry.com
Attachment: dhl_shipment_paperwork 786432956_2020.r00 (contains "dhl_shipment_paperwork 786432956_2020.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12353dae0a101c0468d22dddcf1bd38ffada948e1309e3e7e9faa4fd10f80261/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 10:16:09 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ci2t3lqkcaoai2gsfxo46g6tr75nvfeocme6hz7j7ksp2ehyajqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/12353dae0a101c0468d22dddcf1bd38ffada948e1309e3e7e9faa4fd10f80261

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 12353dae0a101c0468d22dddcf1bd38ffada948e1309e3e7e9faa4fd10f80261

(this sample)

AgentTesla

Executable exe abcf222d2378b2d58504be86fc34eae2334886cf421828deb46638a019972f22

  
Dropping
MD5 06911ba9af1734354a488d70fa2e89ca
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 abcf222d2378b2d58504be86fc34eae2334886cf421828deb46638a019972f22

Comments