MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2eaa42846648798becb860eeebda8eac48d822573fb59e73f273548e87f60aa8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2eaa42846648798becb860eeebda8eac48d822573fb59e73f273548e87f60aa8
SHA3-384 hash: 243b146136b10471cec8898abc1cd7eed9d0363f75980488cf394d282089d8e202a9a778b97be23626bfcc5b7aed302c
SHA1 hash: c8d989bd4c9d4f8714c3da4443a01a5547078a81
MD5 hash: dedfc366d201736d7fb598abcd7e9974
humanhash: north-sixteen-mango-mexico
File name:Bill of Lading_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:435'745 bytes
First seen:2020-05-22 08:46:50 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:37bqTgQNFApYUvswud/oA+sSXTwp3Rq++Ki:C8OueU0wE/oA+bO3Rzi
TLSH FD9423693315F765CD59FDE2224BBDB447B902D4448FB38301336CA1AD171F94E68978
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.vinylbannersprinting.co.uk
Sending IP: 217.174.249.10
From: COSCO SHIPPING INC <support@coscoexpress.com>
Subject: ORIGINAL B/L DOCUMENT / PL
Attachment: Bill of Lading_pdf.gz (contains "Bill of Lading_pdf.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 09:24:39 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 2eaa42846648798becb860eeebda8eac48d822573fb59e73f273548e87f60aa8

(this sample)

AgentTesla

Executable exe c7e5b92f8ea1be3b0ff17bffb4cce4c2848c622f2dda6cd4cac0ee97ecd63aec

  
Dropping
MD5 91a96b260d7f29f81f0c5db09c449815
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7e5b92f8ea1be3b0ff17bffb4cce4c2848c622f2dda6cd4cac0ee97ecd63aec

Comments