MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e427d89ed4ee748159cb98691c814020781a699f274116ab302dddb109fde73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 2e427d89ed4ee748159cb98691c814020781a699f274116ab302dddb109fde73
SHA3-384 hash: 722a89715a39f468548f961145f9a36b2e0b5cb972c3debcc89e50f5c5646ce5664f73bdf6dcaaa73b2d20c121e4c942
SHA1 hash: bb5ad514b3f8fe13b1b12bb8496b175176708dc4
MD5 hash: 8c5e1f22f5a697e390b8873440301d30
humanhash: mountain-wolfram-fillet-muppet
File name:Shipment Documents PLBL Draft img.iso
Download: download sample
Signature AgentTesla
File size:667'648 bytes
First seen:2020-06-30 08:47:15 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:gNmbL0AvosTbY3n7unO21wuOTqHV48NONHStd/EnN98AqZePr5:gMVv64T12qHZ/E78AqZ+
TLSH ADE46C2D3B84BC0AD03C4A3244DA55D4A372E6437622C70F7ACA276C6F166DF7B462D9
Reporter @abuse_ch
Tags:AgentTesla DHL iso


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: vsem-sis.vs.imatic.cz
Sending IP: 82.208.28.99
From: DHL Express Limited <tereza.matousova@infovsem.cz>
Reply-To: andykhan.purchase@aol.com
Subject: AWB Notification: You have A Package With Us
Attachment: Shipment Documents PLBL Draft img.iso (contains "Shipment Documents PL&BL Draft img.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence


Mail intelligence
Trap location Impact
Global High
# of uploads 1
# of downloads 25
Origin country US US
ClamAV Win.Malware.AgentTesla-7660762-0
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/2e427d89ed4ee748159cb98691c814020781a699f274116ab302dddb109fde73/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Injector
First seen:2020-06-30 08:49:04 UTC
AV detection:15 of 31 (48.39%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 26.67%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 2e427d89ed4ee748159cb98691c814020781a699f274116ab302dddb109fde73

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments