MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 698895fe4c44adfeb4eceece06480661fe7b23a0613e437996207a1629727e39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 698895fe4c44adfeb4eceece06480661fe7b23a0613e437996207a1629727e39
SHA3-384 hash: c712cca512fb4790306973de96865189cff0b5e2c4a9578c8009476bcc931609543c8ee59f71a3364a2d22f1deacd517
SHA1 hash: d690bbec274f5ce6563f729f511583cd24c3a926
MD5 hash: 448e8beb4e8a4b7d2f9994f2cba62b73
humanhash: speaker-fruit-india-single
File name:SCANDHL-PDF1822.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:517'927 bytes
First seen:2020-07-09 12:05:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:0Dlb8xBtFp6+PLzm5Q50gPHWShf1aARpeNtScTRwyp:oN8xBTpnC5QbTxnpGQiwyp
TLSH 0DB42374C49EA4D5FDD4EE78020E4E6C51B8B4462BD9E2672906B372BD105784C1EF2F
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx.mitalifashions.net
Sending IP: 103.205.180.100
From: DHL LOGISTICS LTD. <Dymas.Vireak@dhl.com>
Subject: DHL Shipment Successful: Air Waybill no 6522440643
Attachment: SCANDHL-PDF1822.rar (contains "SCAN#DHL-PDF1822.exe")

AgentTesla SMTP exfil server:
smtp.ibtbrussel.eu:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/698895fe4c44adfeb4eceece06480661fe7b23a0613e437996207a1629727e39/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 12:06:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ngejl7smisw75nhm53hamsagmh7hwi5ame7eg6mweb5bmklspy4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 698895fe4c44adfeb4eceece06480661fe7b23a0613e437996207a1629727e39

(this sample)

AgentTesla

Executable exe 816ba0410d3765fad3ab66a6a1b9656e8c0c84a3387611f491be6ac7bad99ed1

  
Dropping
MD5 96212af51809372d313ce7fb9d650ccd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 816ba0410d3765fad3ab66a6a1b9656e8c0c84a3387611f491be6ac7bad99ed1

Comments