MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a34f49aeaf4f551c0a2cc3f82cf5febb111dfbf20760f936d6cda15d47762b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a34f49aeaf4f551c0a2cc3f82cf5febb111dfbf20760f936d6cda15d47762b5
SHA3-384 hash: 6922847b48b144c053c0c3ea40a3c6344f8e6aedb9563411bd613340ed9bb366430587dba28bf7e353da3f88c4c3f990
SHA1 hash: 84f46f42e21249dfe248fb68773887d90bca070c
MD5 hash: 5d8a3b227f46c7c818a1a6d2ad8353a9
humanhash: vegan-item-artist-robert
File name:dhl_doc7348255141.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:368'553 bytes
First seen:2020-07-03 08:31:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ztJifWnORyfBiDiCFHYge8q+NEFjoRBXeU+1EQi8RWQpOfWJLS1gHvI5ZI78:zbiOn/fB4io4l8PEFcedRicIfWJLBw5f
TLSH 527423D12EFE750E19E8F9387BF9B1F348394B1E7322255872772D16E822C84E421DA5
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server9.acidados.net
Sending IP: 176.221.34.180
From: DHL Express <support@dhl.com>
Subject: DHL Shipment Notification : 7348255141
Attachment: dhl_doc7348255141.zip (contains "dhl_doc7348255141.exe")

AgentTesla SMTP exfil server:
smtp.waltartosto.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a34f49aeaf4f551c0a2cc3f82cf5febb111dfbf20760f936d6cda15d47762b5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 08:33:04 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bi2pjgxk6t2vdqfczq7yft275oyrdx57eb3a7e3nntnblvdxmk2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0a34f49aeaf4f551c0a2cc3f82cf5febb111dfbf20760f936d6cda15d47762b5

(this sample)

AgentTesla

Executable exe aedee4f131eef738b19991d52758a3e5aa8b804a6763a9fd48b568f1351d5452

  
Dropping
MD5 20e9fed94db568a0528021b9b86e146a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aedee4f131eef738b19991d52758a3e5aa8b804a6763a9fd48b568f1351d5452

Comments