MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 908b44db519efa5b664ade3863effe7d10d0e71498a57c24cb898e295cdaa49e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 4
| SHA256 hash: | 908b44db519efa5b664ade3863effe7d10d0e71498a57c24cb898e295cdaa49e |
|---|---|
| SHA3-384 hash: | 920a8e5acbed8edc4bf748a530936b999c5de4acfb0d060e8f2a8b785a8ed2eca661aacb5d02940be5c9c41bd3746fc9 |
| SHA1 hash: | 9e9dfa0f6617614788e963ef042fb3758c5f4e99 |
| MD5 hash: | e5ac41a9c6bb08961ec44ad4b201e2a8 |
| humanhash: | vegan-sierra-green-happy |
| File name: | Documentos de DHL..PDF.....gz |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 528'658 bytes |
| First seen: | 2021-04-07 05:14:23 UTC |
| Last seen: | Never |
| File type: | gz |
| MIME type: | application/x-rar |
| ssdeep | 12288:0w0+S6TsJPk4fVNOlOyj/UFVOFS9nn/NM5WtvPkFZ:0h+SHJPk4fVNOl1mYqnFM5l |
| TLSH | D3B423C4C34112D472EB5ED2B4F78184746E649C4B0FBB9A7806E796F0F4470A69EEB2 |
| Reporter |  cocaman |
| Tags: | AgentTesla DHL gz |
cocaman
Malicious email (T1566.001)From: "Gerente de carga de DHL <pagos.fletes@dhl.com>" (likely spoofed)
Received: "from diossa.com.mx (u21557617.onlinehome-server.com [198.251.79.161]) "
Date: "Tue, 06 Apr 2021 15:03:38 -0700"
Subject: "=?UTF-8?Q?Confirmaci=C3=B3n_de_env=C3=ADo_DHL_Express=23?="
Attachment: "Documentos de DHL..PDF.....gz"
Intelligence
File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-04-07 05:15:07 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
10 of 48 (20.83%)
Threat level:
5/5
Detection(s):
Malicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
AgentTesla
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.