MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95126f65519dee72d8b13ba623e0f9d5c67434b9e217f3c1b850e1c4ac38ca52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95126f65519dee72d8b13ba623e0f9d5c67434b9e217f3c1b850e1c4ac38ca52
SHA3-384 hash: c2e82771030881ae6ace6f718276fefdf4f4c0b979c49875468622beb02462309571874bf4c86903dae4f78fe40e2da2
SHA1 hash: 0ad223479c52bb046d88c361da2834cdf32cf0c6
MD5 hash: 91ee59918d00ea54db147de479a1596f
humanhash: texas-bulldog-wisconsin-september
File name:Delivery Note AWD-209383736373-38683635373.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'235'062 bytes
First seen:2020-06-05 13:47:18 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:gWUlzaPiEA4d4BiHjhV/YvPr98VzvBD66tGptLiD/e+aBHjO:EVEjdPNV/Ynr98V86tc9BHjO
TLSH D845335560442553FDBBAED046F16E78E6824AD502C19E88F3384B8ECD3FF866F0926D
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.gr-indtech.com
Sending IP: 210.2.64.2
From: DHL Express <cs@masterbatchvn.com>
Subject: Failed DHL Delivery Notification
Attachment: Delivery Note AWD-209383736373-38683635373.gz (contains "gunzipped")

AgentTesla FTP exfil server:
ftp.irregnancised.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 13:49:03 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sujg6zkrtxxhfwfrhotchyhz2xdhinfz4il7hqnykdq4jlbyzjja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 95126f65519dee72d8b13ba623e0f9d5c67434b9e217f3c1b850e1c4ac38ca52

(this sample)

AgentTesla

Executable exe 623631ebcd52fe082d1f0507fef53e6a3bcec44cf4225550ad077592db0c0832

  
Dropping
MD5 e8167a35a77c13a602173af32fd85837
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 623631ebcd52fe082d1f0507fef53e6a3bcec44cf4225550ad077592db0c0832

Comments