MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12e8951a4c5eafc586f9b3de987e6b97886f3d2c7376a176151aec9f77726891. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12e8951a4c5eafc586f9b3de987e6b97886f3d2c7376a176151aec9f77726891
SHA3-384 hash: 21f21d46162e1bc7581609e280ef43a31f2999d7b92763feb0053771d27deb19811f0e6b8bad92343e89c13c269aacf8
SHA1 hash: e5f0df87a2d6971441c4cde8f4e5f0b20ab7c24a
MD5 hash: f24fd6a3c13a78ce667a5a95c562380d
humanhash: august-arizona-ceiling-magnesium
File name:DHL SHIPMENT DELIVERY 8828555015_PDF.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-13 12:28:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:RfP65HsW7kFuG97mwIxeKg0xb5+aYVfpKy3N5Sxd/SlYggG/aVjwVw5TZrVDLpu0:ROHVywgE5+aCIy/Id/SbNahcsbs
TLSH 78456AF57D4E4458E5198631D02674C3E52E2E8A2E5C4A0F7DAABE0C3E33247A716E4F
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cvp0.108.vuere.ml
Sending IP: 139.59.62.221
From: DHL EXPRESS <dhl-noreply-dhl@108.vuere.ml>
Subject: DHL SHIPMENT DELIVERY (8828555015)
Attachment: DHL SHIPMENT DELIVERY 8828555015_PDF.IMG (contains "DHL SHIPMENT DELIVERY (8828555015)_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis55F35627C69C.2184.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12e8951a4c5eafc586f9b3de987e6b97886f3d2c7376a176151aec9f77726891/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 09:00:39 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=clujkgsml2x4lbxzwppjq7tls6eg6pjmon3kc5qvdlwj653snciq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12e8951a4c5eafc586f9b3de987e6b97886f3d2c7376a176151aec9f77726891

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 12e8951a4c5eafc586f9b3de987e6b97886f3d2c7376a176151aec9f77726891

(this sample)

AgentTesla

Executable exe 7607fe282dd083bc09221a832e4309a259790d3a77b309ddf26d7b3113e1c26e

  
Dropping
MD5 55f35627c69c9154001beeab27b868eb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7607fe282dd083bc09221a832e4309a259790d3a77b309ddf26d7b3113e1c26e

Comments