MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e2880f25ae87f025b2a803991585ad70b02aba22575546a621d42ae316b2f04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e2880f25ae87f025b2a803991585ad70b02aba22575546a621d42ae316b2f04
SHA3-384 hash: ef99d3776150efc8bd27b66d0c3975453726fc15e75584d830aaa0eb0dc6bb986cceac8bf5d6ed3643b552b9ba83946f
SHA1 hash: 5c97991b39dcca16fe0ca04abe923a885fc95787
MD5 hash: d01bffc82b8d87212af7354a3c513c5c
humanhash: snake-mirror-jupiter-twelve
File name:DHL Express Service.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-02 09:02:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:yPCganN6z1DKcXVnuuKe4NxS/awKUu4q1SDvWNcZyszwZ79qrN6oVUON:4anCWCVuX/GajUuj1uvfxwZpUQwN
TLSH A045238683A0C8DED202037206BB2D1B16E7ED1DA2A6571FF75C32F557736D3462E942
Reporter abuse_ch
Tags:AgentTesla DHL img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: box.nealteck.biz
Sending IP: 23.254.228.95
From: Clare Liddiard (DHL) <info@nealteck.biz>
Subject: Re: AWB Number: 6278216733
Attachment: DHL Express Service.img (contains "DHL Express Service.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e2880f25ae87f025b2a803991585ad70b02aba22575546a621d42ae316b2f04/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-10-02 08:00:20 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lyuib4s25b7qewzkqa4zcwc224fqfk5cev2vi2tcdvbk4mllf4ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e2880f25ae87f025b2a803991585ad70b02aba22575546a621d42ae316b2f04

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 5e2880f25ae87f025b2a803991585ad70b02aba22575546a621d42ae316b2f04

(this sample)

AgentTesla

Executable exe cc51d534334fded9ebc813c4ffa0f7c46e97d17592b9973020075c91f2534105

  
Dropping
MD5 f2e51ba10816f4ade285479d0f951dc0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc51d534334fded9ebc813c4ffa0f7c46e97d17592b9973020075c91f2534105

Comments