MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e427d89ed4ee748159cb98691c814020781a699f274116ab302dddb109fde73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e427d89ed4ee748159cb98691c814020781a699f274116ab302dddb109fde73
SHA3-384 hash: 722a89715a39f468548f961145f9a36b2e0b5cb972c3debcc89e50f5c5646ce5664f73bdf6dcaaa73b2d20c121e4c942
SHA1 hash: bb5ad514b3f8fe13b1b12bb8496b175176708dc4
MD5 hash: 8c5e1f22f5a697e390b8873440301d30
humanhash: mountain-wolfram-fillet-muppet
File name:Shipment Documents PLBL Draft img.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:667'648 bytes
First seen:2020-06-30 08:47:15 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:gNmbL0AvosTbY3n7unO21wuOTqHV48NONHStd/EnN98AqZePr5:gMVv64T12qHZ/E78AqZ+
TLSH ADE46C2D3B84BC0AD03C4A3244DA55D4A372E6437622C70F7ACA276C6F166DF7B462D9
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vsem-sis.vs.imatic.cz
Sending IP: 82.208.28.99
From: DHL Express Limited <tereza.matousova@infovsem.cz>
Reply-To: andykhan.purchase@aol.com
Subject: AWB Notification: You have A Package With Us
Attachment: Shipment Documents PLBL Draft img.iso (contains "Shipment Documents PL&BL Draft img.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e427d89ed4ee748159cb98691c814020781a699f274116ab302dddb109fde73/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 08:49:04 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fzbh3cpnj3tuqfm4xgdjdsauaidydjuz6j2bc2vtalo5wee73zzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 2e427d89ed4ee748159cb98691c814020781a699f274116ab302dddb109fde73

(this sample)

AgentTesla

Executable exe 1955d466452cd025985e7bfff38c2c02bd9000a50c47d75ac4d9303a726c074e

  
Dropping
MD5 055ec8209736da7ea8ae8a2dd314feee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1955d466452cd025985e7bfff38c2c02bd9000a50c47d75ac4d9303a726c074e

Comments