MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac9aa9f280c16034b32a0aa081c6ff1cf0d2efb966dd0ece2c9b5417638352b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac9aa9f280c16034b32a0aa081c6ff1cf0d2efb966dd0ece2c9b5417638352b2
SHA3-384 hash: 42fd5f3f589cc985acffc6c0203229dce8d6b249e925dd0c5274fbba79eb41d5d64b07f79511edd777bb579078955aac
SHA1 hash: 18bd52c8cf3fb429cb58699ea94e1144d6fa8d90
MD5 hash: 43f9c077d254e19cbd9dda088cdfdcde
humanhash: leopard-nebraska-avocado-white
File name:SHIPPING DOCUMENTS_doc.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:549'319 bytes
First seen:2020-05-13 06:58:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ILjXoWsh0GsD8JcK+TY+f6BHTCOASIW5qA34D172XO8N7:yjXNbGDt+izCb6Owb
TLSH 12C42384D30FDE8045213ADEA1D4CD9D573AD82EEE8BA059F50175F0BF4093AA5DB3A2
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sh01.tippnet.rs
Sending IP: 93.92.248.35
From: DHL | Express Shipping <express@huiji.com>
Subject: [Urgent] Shipping Documents, Invoice and AWB - DHL parcel (Available)
Attachment: SHIPPING DOCUMENTS_doc.zip (contains "SHIPPING DOCUMENTS_doc.exe")

AgentTesla SMTP exfil server:
mail.acroative.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.W32.Trojan3.APDS.16897.29180.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25081.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 07:37:00 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vsnkt4uayfqdjmzkbkqidrx7dtynf35zm3oq5trmtnkboy4dkkza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ac9aa9f280c16034b32a0aa081c6ff1cf0d2efb966dd0ece2c9b5417638352b2

(this sample)

AgentTesla

Executable exe b81ce07ddc4e67ba7d1f5d1b6893e50eb2c2e0f4a7c5ce3dce1971eec3e6c999

  
Dropping
MD5 72604d8c812c3358e9213024d3c4954d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b81ce07ddc4e67ba7d1f5d1b6893e50eb2c2e0f4a7c5ce3dce1971eec3e6c999

Comments