MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ac29530a3f9bf7ada58f08561be183054f9465d1fae124937d0f8c34f4c1c0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ac29530a3f9bf7ada58f08561be183054f9465d1fae124937d0f8c34f4c1c0e
SHA3-384 hash: b2227e5b9cbb32e06ce0109dbff8812189de94783c6de991c154a6fbe1a73554a7da7400ef88679d242e37f76a6bf026
SHA1 hash: 070db842ed7c25322b870c7ffab9c016ea7b8fb4
MD5 hash: 44976b93ddf9f3f4e37e5aabe9cbbc27
humanhash: spring-ack-helium-sodium
File name:DOC.PDF.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'738 bytes
First seen:2020-05-27 17:58:32 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:FGgAgdcrk1ImsKiMbvICG4PuQdw4cBgpYN6Lc6nzKffhoNcdNCK/:Ffdcjq9GQuK/VnzKhfCu
TLSH C58423FC58FAA2C5FE2B57123BA5B18BDE52264317B3E372857CA5051A6711E009F20F
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: WIN-5Q3WBAFZ1Y8
Sending IP: 103.89.90.246
From: services@dhl.com <admin@mowindra.cf>
Subject: DHL STATEMENT OF ACCCOUNT: OUTSTANDING PAYMENTS
Attachment: DOC.PDF.z (contains "DOC.PDF.exe")

AgentTesla SMTP exfil server:
mail.kalatecnic.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Npe
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 03:58:01 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 2ac29530a3f9bf7ada58f08561be183054f9465d1fae124937d0f8c34f4c1c0e

(this sample)

AgentTesla

Executable exe 0fbf94a719f66bcd7d5d5a8fe06d509bd4bf09ccc7610d6b08a6eb97136bc84a

  
Dropping
MD5 0a9ede2f77583a6f5851822e0e9fa547
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0fbf94a719f66bcd7d5d5a8fe06d509bd4bf09ccc7610d6b08a6eb97136bc84a

Comments