MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32efbc7b174c0eb9b2a659c15bd34b5d414ff55248f08b9b7dcb43a772015693. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32efbc7b174c0eb9b2a659c15bd34b5d414ff55248f08b9b7dcb43a772015693
SHA3-384 hash: 836c8eb2450d419a366ce204ae48224669aace32de3f83d5d917bb620d3b283b0a155a6c27848e455c0906290632f24f
SHA1 hash: 817e7037563a276959aec6a018a13a7b7d9158c6
MD5 hash: 5711a5367413f84733c81bcda2cde19c
humanhash: winner-batman-alabama-two
File name:Delivery Note - AWD 200038485852- 2349203968876.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:967'917 bytes
First seen:2020-06-08 13:27:57 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:FdRoF7C3yanueUNXSg0d2HkuFgNDomPDl/qg1sYPSkKC76h:FdRQ7C3y6UNXSg0sECgN7l/L1swSkKDh
TLSH BC25330D51B37392DD8E634D627DB22CEF3025CC8AC9B2D9EE4C695594380E1EC913AE
Reporter abuse_ch
Tags:AgentTesla DHL geo GRC gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: DHL Express <katewright_dhl@gmail.com>
Subject: Αποτυχία ειδοποίησης παράδοσης DHL
Attachment: Delivery Note - AWD 200038485852- 2349203968876.gz (contains "Delivery Note - AWD 200038485852- 2349203968876.exe")

AgentTesla SMTP exfil server:
ftp.irregnancised.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 13:28:07 UTC
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=glx3y6yxjqhltmvglhavxu2llvau75ksjdyixg35znb2o4qbk2jq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 32efbc7b174c0eb9b2a659c15bd34b5d414ff55248f08b9b7dcb43a772015693

(this sample)

AgentTesla

Executable exe e4e9ef572164bf9a4d3a790e4dbef3d5767f0def7ff10e10031720a3783e2efd

  
Dropping
MD5 9d94c4d5d11889e2f8467803a18fa321
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4e9ef572164bf9a4d3a790e4dbef3d5767f0def7ff10e10031720a3783e2efd

Comments