MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 508dfcfcc57bf069f61c152d92e1f8b4b216918710dbcfd44f1b673832fb94bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 508dfcfcc57bf069f61c152d92e1f8b4b216918710dbcfd44f1b673832fb94bf
SHA3-384 hash: f50f64aa2e348c44e20776c3d924bac29edc36f19b755626463703cafdef0025954d7cf9bcb23096a68b949b80c6898c
SHA1 hash: 372537518527d455ffee2333c3ec8bb5d5e71e6f
MD5 hash: 7a53d60cb6f0014e0133389a4ac46e47
humanhash: wyoming-victor-illinois-utah
File name:Shipping document.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:471'631 bytes
First seen:2021-01-04 13:16:58 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:RmT/el96qW1oc4cuYmT1B9iOYyY6ZVT73uq644olj:RmT/i96qW14EmB1yiX+q643lj
TLSH DCA42328642A59494EDB0FDF2688CC3C5B11D3F436CFC8A9DC8A1B9A0D867BF521D6D1
Reporter abuse_ch
Tags:AgentTesla arj DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: silverworldbd.com
Sending IP: 117.58.240.175
From: DHL express delivery <belayet@saifpowertec.com>
Reply-To: 1louiking@gmail.com
Subject: DHL Express Delivery
Attachment: Shipping document.arj (contains "Shipping document.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/508dfcfcc57bf069f61c152d92e1f8b4b216918710dbcfd44f1b673832fb94bf/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kcg7z7gfppygt5q4cuwzfypywszbnemhcdn47vcpdnttqmx3ss7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/508dfcfcc57bf069f61c152d92e1f8b4b216918710dbcfd44f1b673832fb94bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 508dfcfcc57bf069f61c152d92e1f8b4b216918710dbcfd44f1b673832fb94bf

(this sample)

AgentTesla

Executable exe b3efff040730dd6af8c66d93e0c2bb96273051264abb10182c1c5831b5d7ffcc

  
Dropping
MD5 0c8c0389648196cef02cbdaa2643bf52
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3efff040730dd6af8c66d93e0c2bb96273051264abb10182c1c5831b5d7ffcc

Comments