MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcfa1ff463b4676ec991a65270ad23cdbd779aebc39a9e33912787dded030572. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcfa1ff463b4676ec991a65270ad23cdbd779aebc39a9e33912787dded030572
SHA3-384 hash: 2584aa53fb62db8d6ced3926eda6277d525f7fb72dd39d49f344841c3e993d19e827661a9fdd3d62230426258a107b2c
SHA1 hash: a553fd8dc370aa43b71bfb6fe17bd702dfd35a82
MD5 hash: 07dc848070ad8e64fd7b16d4c71a2add
humanhash: beer-november-freddie-lake
File name:DHL COPY.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:515'869 bytes
First seen:2020-11-13 06:50:01 UTC
Last seen:2020-11-13 09:45:08 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:NEUiNd+ZkcHYBiXxzuOSyK+phQHtqVznk+abz:ywk9Bi84thJkhbz
TLSH F3B4234E2CEB7574C043E48C9C988952D9749BED92C484696EFA1811B09C6FACF4DB2B
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""DHL"<dhldispatch@me.net>" (likely spoofed)
Received: "from localserver.localdomain (unknown [49.239.156.11]) "
Date: "Fri, 13 Nov 2020 00:01:09 +0200"
Subject: "YOUR PARCEL HAS ARRIVED"
Attachment: "DHL COPY.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.2203.11206.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcfa1ff463b4676ec991a65270ad23cdbd779aebc39a9e33912787dded030572/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 16:20:20 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3t5b75ddwrtw5smruzjhbljdzw6xpgxlyonj4m4re6d533idavza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip dcfa1ff463b4676ec991a65270ad23cdbd779aebc39a9e33912787dded030572

(this sample)

AgentTesla

Executable exe 759edbe943ef92a9f0ba2df32b5f93c1d85d0517463f7ecf20ff2c39d1969577

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 759edbe943ef92a9f0ba2df32b5f93c1d85d0517463f7ecf20ff2c39d1969577
  
Dropping
AgentTesla

Comments