MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad53b3523f0fbcded36b53c4a4abc353791e41028721ee863750420ef2612d29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad53b3523f0fbcded36b53c4a4abc353791e41028721ee863750420ef2612d29
SHA3-384 hash: 8d1c4719102a4ca96ecb298a886e8b8817461709ade9dc6afab664788dfcd477537d4de1cfd6c4e2fcd41ff6c8c70ada
SHA1 hash: d7e706af6cf44ac654b06f3ea92b4763f119c9d6
MD5 hash: 1f3a33fa7ebdb08b4150d086b49caf94
humanhash: fourteen-pizza-vegan-romeo
File name:Documentation Dhl File No 0000027399.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:695'783 bytes
First seen:2020-05-12 16:16:10 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:0AuSyRn288pda3dzeOVyM46p+Qj2q3OLt5jhys758ztmGeUxlKaxWUMGldS95OQ+:H/HcYMyM8Qj2q3q4s75GtmGeykhUMGD7
TLSH EFE423695E992CBC4CF294A1320432265C17CAA4D473F6DCFD9CA48B4172229E671FFB
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.arcenody.com
Sending IP: 45.95.169.132
From: DHL Express <mariabrown_dhl@gmail.com>
Subject: [DHL: 8002742088];Failed Delivery Notification
Attachment: Documentation Dhl File No 0000027399.gz (contains "Documentation Dhl File No 0000027399.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.BBFB.UNOFFICIAL
Create hunting rule

Win.Dropper.LokiBot-7778274-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 16:37:08 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vvj3gur7b66n5u3lkpckjk6dkn4r4qicq4q65brxkbba54tbfuuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ad53b3523f0fbcded36b53c4a4abc353791e41028721ee863750420ef2612d29

(this sample)

AgentTesla

Executable exe 4171dc8b0156c5471ff44e843ff7bf8bebb750ff7b1988b4ad18982892492093

  
Dropping
MD5 cc7ddaa3d2de1b774ca73d8f2af97968
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4171dc8b0156c5471ff44e843ff7bf8bebb750ff7b1988b4ad18982892492093

Comments