MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85e0d4cdf095ef73f2eb3e706d48c0f53645db73a9dc70f0352ed4aa43dacc22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85e0d4cdf095ef73f2eb3e706d48c0f53645db73a9dc70f0352ed4aa43dacc22
SHA3-384 hash: edd57fbba56512b551c01566771772d9126969289edff1320b082bc1edff4b2a965b27b9b2a8a1183ba1d271f6b9358c
SHA1 hash: 1f753eb911730ffe97752e67d8eca24a7a5bef1d
MD5 hash: 7ae37909ccbce432764a62cc094d3a65
humanhash: maryland-five-cup-batman
File name:BL Draft Original Shipping Documents.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'274 bytes
First seen:2020-06-02 09:36:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:VJgffxhB9XZdnC3uqr03SXPLjwqAc9C0R1f:VaVtZFC3zjXPLjL/CG
TLSH 88A42381A81F67EAC36B878B04CDEF45636A5BB54215949F2C284550786CF6B3F08FF8
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns1.suncoastpkg.pw
Sending IP: 139.59.61.226
From: DHL AWB Shipment<dhlexpress@express.com>
Subject: DHL Shipment Details :BL/AWB DETAILS (AWB2058917205)
Attachment: BL Draft Original Shipping Documents.rar (contains "BL Draft & Original Shipping Documents.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 10:37:09 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxqnjtpqsxxxh4xlhzyg2sga6u3elw3tvhohb4bvf3kkuq62zqra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 85e0d4cdf095ef73f2eb3e706d48c0f53645db73a9dc70f0352ed4aa43dacc22

(this sample)

AgentTesla

Executable exe aaccb4cfcfb85362ab038c8944483b40b69cae5e0fa62d058e8783ae01b9ab8e

  
Dropping
MD5 0fa852cf0e77b04eac1c5a2c68245599
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aaccb4cfcfb85362ab038c8944483b40b69cae5e0fa62d058e8783ae01b9ab8e

Comments