MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aac4d4de45de5e25cce16ea8be99878919b4ed69e804b18741e54625da8ada32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aac4d4de45de5e25cce16ea8be99878919b4ed69e804b18741e54625da8ada32
SHA3-384 hash: f547afadee3e2c70cc5d983635179ac5690ee594ca31a59eeee204f03c86fadaab6ded3a35d54916b05ae140c81f80fb
SHA1 hash: b3dd98ceb4b334889e2697b86f859d4cc026fb2a
MD5 hash: a15dff03e348352823c03104266774f8
humanhash: mars-seven-whiskey-magazine
File name:INVOICE AWB_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:516'534 bytes
First seen:2020-05-01 14:30:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:e37/yYz4fjMhdEMnuKOrYgtsHbAf7PWsXWH8QWye1kBBj/0XrCsW:eLbz4b0JrMsHbsW+WHs1G+CN
TLSH 11B42381264843F6D92F842F66E947DB52D8F7C1D4390166F22C32F159CBFEA6D21293
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.dls.co.id
Sending IP: 103.253.68.67
From: DHL | Express Shipping® <norepy.express@dhl.com>
Subject: Shipping Documents Invoice and AWB
Attachment: INVOICE AWB_pdf.zip (contains "INVOICE & AWB_pdf.exe")

AgentTesla SMTP exfil server:
mail.acroative.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-7744093-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Injector.ELSC.32193.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 14:36:06 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
32 of 48 (66.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vlcnjxsf3zpclthbn2ul5gmhrem3j3lj5acldb2b4vdclwuk3iza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip aac4d4de45de5e25cce16ea8be99878919b4ed69e804b18741e54625da8ada32

(this sample)

AgentTesla

Executable exe 47dc93d9f50e610072c38ed05d454b31b9a4d9c31f2abc75840dea36ec4ef374

  
Dropping
MD5 16c3062d876d32583b7c07a5d4d48058
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 47dc93d9f50e610072c38ed05d454b31b9a4d9c31f2abc75840dea36ec4ef374

Comments