MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86c120781b2c6aa88912ec927794a872ca51d239db2e3123953989767929dc64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86c120781b2c6aa88912ec927794a872ca51d239db2e3123953989767929dc64
SHA3-384 hash: 0e991c4a9e642488027b23b37265b9387b4664e5a13540534b5dadc45ac0f190ba0e96460c25469da7ca2eb75f3343e9
SHA1 hash: 78e8b4640956643418de07a96dd6f3f5dcb7ca26
MD5 hash: 0dbba83f86435ae8f84e4e9fb8781b53
humanhash: vegan-tennis-nebraska-robin
File name:Doc162020094753525765344650094480.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:4'420'977 bytes
First seen:2020-07-18 07:54:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:oMxM9GRVUlTfYcxtWcvcGGYEiUOVbYBefgbopLjnR1gpiMGAcG3q:oMxM9GRVUlgcvc7P4VbY+gboNV1gp8Ga
TLSH 4026330E8A6C76B78771BD6D86EA8921AE1F1674B2787307C271741CEC03532E166FB1
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: [104.36.229.108]
Sending IP: 104.36.229.108
From: DHL Customer Support <support@dhl.com>
Subject: DHL出货通知：36443244716
Attachment: Doc162020094753525765344650094480.pdf.zip (contains "Doc#162020094753525765344650094480.pdf.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86c120781b2c6aa88912ec927794a872ca51d239db2e3123953989767929dc64/
Threat name:
Win32.Trojan.Fuery
Create hunting rule
Status:
Malicious
First seen:
2020-07-18 07:56:07 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3asa6a3frvkrcis5sjhpffiolffdurz3mxdci4vhgexm6jj3rsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86c120781b2c6aa88912ec927794a872ca51d239db2e3123953989767929dc64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 86c120781b2c6aa88912ec927794a872ca51d239db2e3123953989767929dc64

(this sample)

AgentTesla

Executable exe 5bf9c6dd99a8c7ee59efcf09ff2b4ee5b5f51aab9ad91cd2aa0fca4b0ae975ba

  
Dropping
MD5 ffceee8b1fe197a9cac46ae74a66bccd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5bf9c6dd99a8c7ee59efcf09ff2b4ee5b5f51aab9ad91cd2aa0fca4b0ae975ba

Comments