MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87811912da6c8d454dd3a2712a8726afda56f30f0cea0b56b9a12961c35728e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87811912da6c8d454dd3a2712a8726afda56f30f0cea0b56b9a12961c35728e2
SHA3-384 hash: e8f45f0b17dd83f822b0cbd87db6b1c9eb5d02894f304ecd122ca1ddc1cfaf7ed8f121362b5b3f7c6e6667dc2da31e52
SHA1 hash: e0f75b28802b8ad7555ee1fbb311c51f8596797a
MD5 hash: 67cb3b5b171ab3ee60bd051c9dc3e940
humanhash: kitten-jersey-snake-autumn
File name:Please confirm your shipment address.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:615'723 bytes
First seen:2020-07-16 06:43:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:aDs2xivPgrwbprN35aJZR9Y1UqxD5TtPjDFWdQkoh7RZkyNb:jeiXgCprNWVY1UUD5T0ah7Z
TLSH C3D433C9148FBF25961AEFCAB24AA1851C02BE1271CD4A442A1C9D9234BFF47D057F9B
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 104.168.202.47
From: China DHL Express <dhlcnsendreq6@dhl.com>
Subject: 需要采取的行动 - Please Confirm Your Shipment Address
Attachment: Please confirm your shipment address.zip (contains "Please confirm your shipment address.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.386.15284.14427.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87811912da6c8d454dd3a2712a8726afda56f30f0cea0b56b9a12961c35728e2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 00:52:18 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6arsew2nsguktotujysvbzgv7nfn4ypbtvawvvzueuwdq2xfdra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 87811912da6c8d454dd3a2712a8726afda56f30f0cea0b56b9a12961c35728e2

(this sample)

AgentTesla

Executable exe 1bd7fcf59176999d49faee562f699d840b4c1dd697055fa66e6a52c0846a9b42

  
Dropping
MD5 fd67f2468786ab7a02d00e3abe4ed5ac
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1bd7fcf59176999d49faee562f699d840b4c1dd697055fa66e6a52c0846a9b42

Comments