MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2503c878490378d72ff4570249492352824157b7ca176764f31fe76f056c4864. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2503c878490378d72ff4570249492352824157b7ca176764f31fe76f056c4864
SHA3-384 hash: 95a4492e5b2a320c0ccdda1336eb3a5193c7783b5d725b5864358fdd0ca6f03f930d4fa26ab54c80c92ed37186de88fb
SHA1 hash: eaf1a239a5fd7826dc5ea09b58e2836b22d73487
MD5 hash: 5d88e0f725389e4f6d62cbcced7968d1
humanhash: kitten-zulu-yellow-carolina
File name:Shipping document.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:429'883 bytes
First seen:2020-06-02 07:44:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:ylY9kz3XSrcxlaGdBTQ8zkboj6MBFx9erZwoFi5jg2eV8vMc0SH7VsQcmHu0s/Bh:vwHIydQaMS6AFerZTqMf1SH7VsQzmz
TLSH 899423A770414D4B323DC8F2D1DF719C2A0727E95B21DBD743404ABE53A3EB6AA501AB
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: "DHL Customer Support" <ilia58@dir.bg>
Subject: RE: DHL Shipment Notification: 6338632252
Attachment: Shipping document.rar (contains "Shipping document.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 08:36:26 UTC
File Type:
Binary (Archive)
Extracted files:
287
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eub4q6cjan4nol7uk4bessjdkkbecv5xzilwozhtd7tw6blmjbsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2503c878490378d72ff4570249492352824157b7ca176764f31fe76f056c4864

(this sample)

AgentTesla

Executable exe a9d7b84cfc7fa078466ceade8534942fb80b0acd25ba3f8b848dfc12dc1fae21

  
Dropping
MD5 5a79ff274a3007152a7bdb2dfa7da370
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9d7b84cfc7fa078466ceade8534942fb80b0acd25ba3f8b848dfc12dc1fae21

Comments