MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 782733f13e81888fbff343d72492896e12e976811a2778376b8ef96f67b838a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 782733f13e81888fbff343d72492896e12e976811a2778376b8ef96f67b838a6
SHA3-384 hash: 89f6be5f662aa5a62400e68845f809e16f1cab3ed35c3a83f21fcc7a0429d47acdb16e4cc98d54b2491bd03585a9d291
SHA1 hash: dc26b8e6e0ba98168a2cc2a1f407ab37bb9c3612
MD5 hash: 4760e37505326f453187832873ae53e6
humanhash: charlie-michigan-low-delta
File name:DHL.TRACKING.DETAILS.PDF.Gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:549'442 bytes
First seen:2020-12-25 07:56:01 UTC
Last seen:2020-12-29 08:00:28 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:DvKZCEJRs4dSHZqvqBjWBWk0Tl3QYa7pmBDt/YlU:G/wuS5i2jEXa1QYa7pIqK
TLSH 96C4236B58D6A642E663F9F27DE1D79CDCA030D2B486019A32386F2D136614D4783CDF
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: soulbiketours.com
Sending IP: 193.29.104.246
From: DHL International GmbH<javi@soulbiketours.com>
Reply-To: Agent<officeme47@yandex.com>
Subject: SHIPPMENT NOTIFICATION URGENTLY NEEDED
Attachment: DHL.TRACKING.DETAILS.PDF.Gz (contains "DHL.TRACKING.DETAILS.PDF.exe")

AgentTesla SMTP exfil server:
web2.changeip.com:587

Intelligence

File Origin
# of uploads :
109
# of downloads :
872
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25510.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/782733f13e81888fbff343d72492896e12e976811a2778376b8ef96f67b838a6/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-25 06:50:29 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=patth4j6qgei7p7tiplsjeujnyjos5ubditxqn3lr34w6z5yhcta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/782733f13e81888fbff343d72492896e12e976811a2778376b8ef96f67b838a6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 782733f13e81888fbff343d72492896e12e976811a2778376b8ef96f67b838a6

(this sample)

AgentTesla

Executable exe f3861ce2254ecdb6dc2cce1060dc8cfb2dd89b53fddae82321dd84f45c7bb7f4

  
Dropping
MD5 c591a02b94dc1639b74e79170d354284
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f3861ce2254ecdb6dc2cce1060dc8cfb2dd89b53fddae82321dd84f45c7bb7f4

Comments