MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81835e13fb62ff9b6879491c7cd42062bca6956a7612c79b20284ccddbd47333. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81835e13fb62ff9b6879491c7cd42062bca6956a7612c79b20284ccddbd47333
SHA3-384 hash: 51dccc5acb4c844f2d58a811a3f9edb777942fb0d163a766db9ea78cb10057a85a613e60f453fd5996f287b2781f0121
SHA1 hash: cae95bfeadba7fc9db0c4accabcce3c8515dfd27
MD5 hash: dbf042bf870a4492fbfbae397c9432e6
humanhash: potato-pennsylvania-texas-single
File name:DHL invoice_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'492 bytes
First seen:2020-05-04 17:39:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+uMwCxMeItFI9qVKoblqM0ZAJB3OXqxXT9A6Y73qJ/W:QwC8fx9lqM0ZeUUD9A6W3qZW
TLSH E45423A2C7172EA53A7BB381FD7A0BF6AB48414C5D4AF03791B24101B1FB9933C39995
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-162094.uk-south-2.nxcli.net
Sending IP: 165.84.219.70
From: DHL EXPRESS <support@dhl.com>
Reply-To: support@dhl.com
Subject: You have A Package With Us...DHL Consignment AWB//2116898656.
Attachment: DHL invoice_pdf.zip (contains "invoice.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.21412.21358.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21615.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 04:03:16 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qgbv4e73ml7zw2dzjeohzvbamk6knflkoyjmpgzafbgm3w6uomzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 81835e13fb62ff9b6879491c7cd42062bca6956a7612c79b20284ccddbd47333

(this sample)

AgentTesla

Executable exe dfc4d773153275e9948534f76c86b6d336eda96d6ec194b79a8aa6e2c845cfc2

  
Dropping
MD5 1431a3ef4335e07833f0f93be5204306
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dfc4d773153275e9948534f76c86b6d336eda96d6ec194b79a8aa6e2c845cfc2

Comments