MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a61cad7d6a6075f7784f06b386488f7ea1a7dc036928cb206707f04b9c8a2be8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a61cad7d6a6075f7784f06b386488f7ea1a7dc036928cb206707f04b9c8a2be8
SHA3-384 hash: 3b6ba26227d170f229b743370eb851089391715a599a616c102b4171525d35a0e59ae7e8ada9c3963f8b6551f0c6756a
SHA1 hash: 24f7a3d366152f8b5819d2f5b1b47fdb9b730b65
MD5 hash: 7f85bab8858ea6f716b2bef3979fde3e
humanhash: twelve-rugby-kitten-autumn
File name:DHL_23072020_AWB_998227999_INV..zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:977'065 bytes
First seen:2020-08-05 12:12:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ZgHRLBRBfzskLhCimyvK3BEihCVGPO/ENep4GNRKXAoUcx6TFX/mOX7cePITIjzh:CjB7/hMy2mKx21bNIXMTTp+Oced+Y
TLSH 8625233312578D12C8820793C6D871F43B4B9DF2865087C5B6D9277EC1B3AAA2CED5A9
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.macartajans.com
Sending IP: 89.252.130.69
From: DHL | Express Shipping <info@asadigroup.com>
Subject: Urgent: Shipping Documents (Reminder)
Attachment: DHL_23072020_AWB_998227999_INV..zip (contains "DHL_23072020_AWB_998227999_INV..exe")

AgentTesla SMTP exfil server:
smtp.wtgriderline.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.211.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a61cad7d6a6075f7784f06b386488f7ea1a7dc036928cb206707f04b9c8a2be8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:14:06 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uyok27lkmb27o6cpa2zymsepp2q2pxadneumwidha7yexhekfpua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a61cad7d6a6075f7784f06b386488f7ea1a7dc036928cb206707f04b9c8a2be8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a61cad7d6a6075f7784f06b386488f7ea1a7dc036928cb206707f04b9c8a2be8

(this sample)

AgentTesla

Executable exe 84dff6eb89c701ad58ea9986ee5aca8065b7ebfd0b28f70a153ca45b238970d3

  
Dropping
MD5 f980899ff78b1a83c873b4592dab4ccc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84dff6eb89c701ad58ea9986ee5aca8065b7ebfd0b28f70a153ca45b238970d3

Comments