MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6f58f6014f2fa2b58b82be729d5208e41f2e4436d3b6405de2401766f1d83b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6f58f6014f2fa2b58b82be729d5208e41f2e4436d3b6405de2401766f1d83b8
SHA3-384 hash: cda7b0dcd7b316c6a1ad110a0913430c8c593837423742acf7982aa57e31d59cd9a1aba8d9f190d0f29d0dae1f9f5ecc
SHA1 hash: 4ff8644b64efd03c45c1716fef58104794b163e8
MD5 hash: 2563ff20cd20dcfe8edd46b2471f9877
humanhash: tennessee-low-cat-shade
File name:Shipping Documents.pdf.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:357'335 bytes
First seen:2021-03-30 06:23:57 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:YhvKhaWH4KyiGtbRXPtzSXtlR8dWJLJXFwzgRG2a9suwwv8jGvWjAs:YhvKAWYK6bxPdSXGdWrXFwuTkEBAs
TLSH 06742305D92AB70655BAF119E3F2A7D30E5D46456A7C0A0753B8AF190CFFBB22BD8031
Reporter abuse_ch
Tags:cab DHL


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hp0.323.mxsen.cf
Sending IP: 165.22.111.172
From: "DHL Express" <info@323.mxsen.cf>
Subject: DHL Shipment Arrival Notification AWB NO: 26859970
Attachment: Shipping Documents.pdf.cab (contains "Shipping Documents.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodCab-A.10707.25966.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6f58f6014f2fa2b58b82be729d5208e41f2e4436d3b6405de2401766f1d83b8/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 06:24:13 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=632y6yau6l5cwwfyfptstvjarza7fzcdnu5wibo6eqaxm3y5qo4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/f6f58f6014f2fa2b58b82be729d5208e41f2e4436d3b6405de2401766f1d83b8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab f6f58f6014f2fa2b58b82be729d5208e41f2e4436d3b6405de2401766f1d83b8

(this sample)

AgentTesla

Executable exe 46d5a51da189bda1bfc4506c210db21cf2baf3d06ff2a8f566a46dcd12f13484

  
Dropping
MD5 8dc337fe3ed9256df0a5b6ee31be7436
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46d5a51da189bda1bfc4506c210db21cf2baf3d06ff2a8f566a46dcd12f13484

Comments