MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ae65b19fe6b5d501853314fc933ca799820ddb458bb4264ec1e462c741dc1ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ae65b19fe6b5d501853314fc933ca799820ddb458bb4264ec1e462c741dc1ae
SHA3-384 hash: cd07e043f2ce0f5ebf82982fa25cf6091a74475def0017ffd00b6f41605173c4b8c1997b6e40de0d2f39f8e7dbd46795
SHA1 hash: 86336f536bd86727ce793d9444532d0b633b8a64
MD5 hash: 525858682f510e497eb88d398c45083b
humanhash: early-london-berlin-north
File name:Dhl Shipment Bl Pape % Documents.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:279'508 bytes
First seen:2020-07-30 10:09:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:kD+vkF46tQh/chYp5gFaTj7o9ZXpAUmOQoR2j0hGh+9HGHTAuHi2sMuT56VcI:kCsF461GrgFeYbeUmiR2wYwHGzLSf2l
TLSH A354230D2A7937671C5F70C1248A488FD9B0B9B35A4FCFED97FA4B308E78256189419E
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.elero.gq
Sending IP: 45.89.66.110
From: DHL | Express <postmaster@elero.gq>
Reply-To: DHL | Express <noreply@elero.gq>
Subject: DHL Shipment
Attachment: Dhl Shipment Bl Pape % Documents.zip (contains "Dhl Shipment Bl Pape % Documents.exe")

AgentTesla SMTP exfil server:
mail.gruppoei.tk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.725826.14263.30859.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ae65b19fe6b5d501853314fc933ca799820ddb458bb4264ec1e462c741dc1ae/
Threat name:
ByteCode-MSIL.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 10:11:04 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bltfwgp6nnovagctgfh4sm6kpgmcbxnulc5uezhmdzdcy5a5ygxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ae65b19fe6b5d501853314fc933ca799820ddb458bb4264ec1e462c741dc1ae

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0ae65b19fe6b5d501853314fc933ca799820ddb458bb4264ec1e462c741dc1ae

(this sample)

AgentTesla

Executable exe fbfa1fd030f6c63104868de7dc73436f4f6c49635b3d25effa4f7423df2349b2

  
Dropping
MD5 d3e448f4a6977cf1ada78b06d98b99d1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fbfa1fd030f6c63104868de7dc73436f4f6c49635b3d25effa4f7423df2349b2

Comments