MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcb8bdf2a76b4d032d31a0dd6ff88dbd3580f771470f77f566f7e275381a1f89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcb8bdf2a76b4d032d31a0dd6ff88dbd3580f771470f77f566f7e275381a1f89
SHA3-384 hash: e6acba3d1e0e613d4d1e427d97dd19802cedf2a5a4b477b289d00f4f20a4a27653839d9a024ca6e07c4e417489842932
SHA1 hash: 66ea26321c7f0d0b113b81b638a9b75cb5aa8bb6
MD5 hash: 7b7739d49290b4832ea4d14ca8066b44
humanhash: oven-single-wolfram-potato
File name:GUIA 3434100412.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:377'644 bytes
First seen:2020-07-09 18:26:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:n382kWd8AO7vC4HF9yVk0w2ENlT0YK/kbaBBi9MgVDCYFuke4ANi48CkXp0Yno:RkWiD9y+0xENlTjK/yavKMgVDCaervj
TLSH 1A84234DAF774C6B64A60581DC71323A7DD8A6B30EBCE46D141E1C65B19BECA0F82E0D
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-744091.hostwindsdns.com
Sending IP: 192.236.163.85
From: Milagros Sevilla (DHL) <Milagros.Sevilla@dhl.com>
Subject: RE: ÚLTIMO AVISO DE COLECCIÓN GUIA DHL 3434100758
Attachment: GUIA 3434100412.pdf.rar (contains "ZgPNRmA9FUAPwwl.exe")

AgentTesla SMTP exfil server:
mail.mehatinfo.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcb8bdf2a76b4d032d31a0dd6ff88dbd3580f771470f77f566f7e275381a1f89/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 18:28:08 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3s4l34vhnngqgljrudow76enxu2yb53ri4hxp5lg67rhkoa2d6eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar dcb8bdf2a76b4d032d31a0dd6ff88dbd3580f771470f77f566f7e275381a1f89

(this sample)

AgentTesla

Executable exe 5523b6368db651832484529a46f8c4ce6661b4770e10081937b4014c97c2197a

  
Dropping
MD5 605e2e137b27ca373e5768af5258559d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5523b6368db651832484529a46f8c4ce6661b4770e10081937b4014c97c2197a

Comments