MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 376b42b54842a28acf2b905ae7f1255eeeb63b57afcf4abd1d291f2e23d1161d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 376b42b54842a28acf2b905ae7f1255eeeb63b57afcf4abd1d291f2e23d1161d
SHA3-384 hash: 5507e4d350d49e95d246da5e3a9c505d877925de6787f316605fe1a3f2fbd6865d1e132eaa5e948a82aafdd78a150973
SHA1 hash: 21a6d0db32c1a6f5c17b700ad6961452e86d2e0a
MD5 hash: ff602021e3287428f8b130aacaaea076
humanhash: michigan-fifteen-oklahoma-yankee
File name:Delivery Note AWD-200837363473-3837373633.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:967'922 bytes
First seen:2020-06-08 12:24:05 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:e853lq4unRWyZGIrIMupKbHehJPBVMzIOyLLFVPm6g/u5lB7ik:e6lD6wyZG0uCehfmzIOyL66gm5/ek
TLSH 9D253323D2CB7368B455191ED6A7B9AC13E6309A08CEDD3D8C6B5F7891C0B96421F6CC
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.gr-indtech.com
Sending IP: 210.2.64.2
From: DHL Express <cs@masterbatchvn.com>
Subject: Failed DHL Delivery Notification
Attachment: Delivery Note AWD-200837363473-3837373633.gz (contains "Delivery Note AWD-200837363473-3837373633.exe")

AgentTesla FTP exfil server:
ftp.irregnancised.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:26:05 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5vufnkiikrivtzlsbnop4jfl3xlmo2xv7huvpi5feps4i6rcyoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 376b42b54842a28acf2b905ae7f1255eeeb63b57afcf4abd1d291f2e23d1161d

(this sample)

AgentTesla

Executable exe 2b17be66ea870217fd5ad3e78aac4f7997af78af9e93a7474d488b7478439e83

  
Dropping
MD5 74174f23da606391d2c9301eb0de766a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b17be66ea870217fd5ad3e78aac4f7997af78af9e93a7474d488b7478439e83

Comments