MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 525ee9f4a370f79939e8cd9b9fe0fcb0914a159a0f4271bd0bfb8d643627c994. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 525ee9f4a370f79939e8cd9b9fe0fcb0914a159a0f4271bd0bfb8d643627c994
SHA3-384 hash: 9663059842631988ac3ac6055a4e32610733d86b90c06d349a4b8ca21db84a513d3d4b206f164d8783a3e0e53044d085
SHA1 hash: 74183fb42b27507f5bcb53d34be2fc48c43d47d0
MD5 hash: 6fd6a8e6ba89d509fb482cef860e6e6d
humanhash: paris-purple-stream-golf
File name:dhl_doc97656789765.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'097'107 bytes
First seen:2020-05-14 16:18:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:VAi0lrr4btPB3Ur3WbAG8umHnoXhFTiY31xTibmzaxB4:x0ZrMtPBkr3yffDxFeKxTYz4
TLSH 4335335FA72908D7FB4B148E142F06B6888215755AF320469F38C7D3B7CE195A9EE0F4
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: so.solzuwebapi.live
Sending IP: 45.95.171.193
From: DHL Express Chile <no_reply@dhl.cl>
Subject: Documentos de envío originales
Attachment: dhl_doc97656789765.zip (contains "dhl_doc97656789765.exe")

AgentTesla SMTP exfil server:
smtp.aiotecs.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 16:35:40 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kjpot5fdod3zsopizwnz7yh4wciuufm2b5bhdpil7ogwinrhzgka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 525ee9f4a370f79939e8cd9b9fe0fcb0914a159a0f4271bd0bfb8d643627c994

(this sample)

AgentTesla

Executable exe bacabf653777054e81125cfb9c290619a1febfb5c98e6d9e9d81edca2d7f95d8

  
Dropping
MD5 a5f7c9b358a68ab9b22b6f9fc494a085
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bacabf653777054e81125cfb9c290619a1febfb5c98e6d9e9d81edca2d7f95d8

Comments