MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 311475f98b65b4c4ac46d0c33702cba79d59c5e601ccb80688b645fe38eaa750. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 311475f98b65b4c4ac46d0c33702cba79d59c5e601ccb80688b645fe38eaa750
SHA3-384 hash: 822504a5687bdf7b771bed39755056b7e625a8f65332a5172004b8dd2320d43c4b04e7ee0f82f72152a59d8b5300e745
SHA1 hash: b53f5f0271c2e5dceeb77ab8d50881323c1fc5f4
MD5 hash: 1cf04218f3b3104ea920d68fe294682e
humanhash: earth-nuts-mountain-nuts
File name:DHL Reciept_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:707'686 bytes
First seen:2020-08-31 05:49:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:YthN3COMkzN9XdhyqcX8THoP9qdjrS1RjR3MxySOM19szPbUDG:eyOMmbRTHbrS3jR3MxyS79s/2G
TLSH 3CE423D459FC0FB3A66773BB1D91A08D520F66968EC53AF37F22020586501CF4A67ABC
Reporter abuse_ch
Tags:AgentTesla DHL Hostwinds rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-768207.hostwindsdns.com
Sending IP: 192.119.84.82
From: DHL Customer Support <noreply@division.us>
Subject: DHL Parcel Ready For Drop Off
Attachment: DHL Reciept_pdf.rar (contains "DHL Reciept_pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/311475f98b65b4c4ac46d0c33702cba79d59c5e601ccb80688b645fe38eaa750/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 00:13:56 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gekhl6mlmw2mjlcg2dbtoawlu6ovtrpgahglqbuiwzc74ohku5ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/311475f98b65b4c4ac46d0c33702cba79d59c5e601ccb80688b645fe38eaa750

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 311475f98b65b4c4ac46d0c33702cba79d59c5e601ccb80688b645fe38eaa750

(this sample)

AgentTesla

Executable exe 640e087a78aa77a9bb49027500f1f29f9d31f5b64c13c99b690ea813d0737fd4

  
Dropping
MD5 112caf0a6d0c05d47433868ea65018fa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 640e087a78aa77a9bb49027500f1f29f9d31f5b64c13c99b690ea813d0737fd4

Comments