MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88905cf9ea5085d7264e7b87ae4fc427253ec552df9e3c56a0848e2ff49178b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88905cf9ea5085d7264e7b87ae4fc427253ec552df9e3c56a0848e2ff49178b2
SHA3-384 hash: 1d0f014102041a29076169882b3d0f72cf38807b9e49fbcea914579e827975ed0a6c8a27bffeb629dd9ee0c1a5c0c0b6
SHA1 hash: 630d64b6116a40a6d43cc2488711dd33ea68c843
MD5 hash: bec60227238d8667d8ed447d646a52a0
humanhash: golf-music-oregon-colorado
File name:BL Original shipping documents AWB parcel tracking 1.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'445'706 bytes
First seen:2020-08-04 06:34:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:9gLUFuUPoUqOy0ovKoKxSVVFOQHNedGX/452Ljp8mPncUTpL8y0EJ0iYBnuaQ6QT:9ggsUPpey1wFDZrdppTp7BanTQ1bQC
TLSH 2965337FB520924C8AF58FF5898452637A92F74275726E0BA306B9ED64E60F70330E4D
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: noway.com
Sending IP: 45.127.62.50
From: DHL Express Service<dhlexpress@dhl.com>
Subject: DHL International Express Shipment, waybill and parcel tracking-7253****8341
Attachment: BL Original shipping documents AWB parcel tracking 1.zip (contains "BL & Original shipping documents AWB & parcel tracking 1.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.53037.25565.25733.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88905cf9ea5085d7264e7b87ae4fc427253ec552df9e3c56a0848e2ff49178b2/
Threat name:
ByteCode-MSIL.Trojan.AgnetTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 06:36:06 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rcifz6pkkcc5ojsopod24t6ee4st5rks36pdyvvaqshc75erpcza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88905cf9ea5085d7264e7b87ae4fc427253ec552df9e3c56a0848e2ff49178b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 88905cf9ea5085d7264e7b87ae4fc427253ec552df9e3c56a0848e2ff49178b2

(this sample)

AgentTesla

Executable exe 08443bf9fa957824d3f097be9f7171d11ca06a26bc1e94e518b0654bf9ef5c32

  
Dropping
MD5 a2fabb659641023048269765790f973e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08443bf9fa957824d3f097be9f7171d11ca06a26bc1e94e518b0654bf9ef5c32

Comments