MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2533641c501a94bcbe691a2d3aaab9b27c9524dfa291b17898993c0a1e78802c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2533641c501a94bcbe691a2d3aaab9b27c9524dfa291b17898993c0a1e78802c
SHA3-384 hash: 5c3e7e1cec8fead8a622e4d8e948683efb2b033fb2f72bff2b7724d660b27616a909a06b5b4ac716b9adcd4852e0ab33
SHA1 hash: 3e1add3b0a5774d29044680c6b345bf461bd16fb
MD5 hash: 545cd30cb680ff909a2634be35cd8e47
humanhash: aspen-lithium-uranus-yellow
File name:DHL_AWB 1008936572891_pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:505'059 bytes
First seen:2020-08-14 10:32:39 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:4I97XosyhNxnOuBtVl8zwX1o+768hvevk++2FWtm0i:4A4syOuLD8zEP68dz+++Ei
TLSH 0DB423E45258AC4D14A67C612369E063AD6431350F602BE78295BFFFE0109F46FACFC6
Reporter abuse_ch
Tags:7z AgentTesla DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: de.uitn.com
Sending IP: 144.76.245.34
From: DHL EXPRESS <CUSTOMERSERVICE@DHL.COM>
Reply-To: DHL EXPRESS <soomla6384@yahoo.com>
Subject: Ref: DHL_AWB #1008936572891
Attachment: DHL_AWB 1008936572891_pdf.7z (contains "DHL_AWB #1008936572891_pdf.exe")

AgentTesla SMTP exfil server:
mail.specialmetal.ir:587

AgentTesla SMTP exfil email address:
info@specialmetal.ir

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2533641c501a94bcbe691a2d3aaab9b27c9524dfa291b17898993c0a1e78802c/
Threat name:
ByteCode-MSIL.Trojan.LokiSteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:34:07 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=euzwihcqdkklzptjdiwtvkvzwj6jkjg7uki3c6eyte6auhtyqawa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2533641c501a94bcbe691a2d3aaab9b27c9524dfa291b17898993c0a1e78802c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 2533641c501a94bcbe691a2d3aaab9b27c9524dfa291b17898993c0a1e78802c

(this sample)

AgentTesla

Executable exe 894460163492923a4a19c16f1b31698bbfe8431fea36d3bef84c031f30069c4f

  
Dropping
MD5 7687a3e27a0628c7f184eeb1152f2f01
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 894460163492923a4a19c16f1b31698bbfe8431fea36d3bef84c031f30069c4f

Comments