MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb698c48127fe0398c2ab555fb0c1b75cb35c4a538eca9324b5dac711ad0da1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb698c48127fe0398c2ab555fb0c1b75cb35c4a538eca9324b5dac711ad0da1f
SHA3-384 hash: bf2eea15af8738e6b8428a64a30bbfe8c5a44787977fc8139043207ffbda83c91e2aafb6aa5b765ad965b814d9260c5b
SHA1 hash: 0992a87a7807262f39411e55f9b94676360cfaa5
MD5 hash: 0dd2daa477832f140690cbf10208765b
humanhash: ohio-three-spaghetti-shade
File name:Emergency Situation Surcharge Update.PDF.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:422'571 bytes
First seen:2020-07-10 07:15:59 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:rkc+RUWnC/Ddu5xUsBaUyuRGw/sK2WGpT8n9NtQTafqwo88dOCmpnzHiFUmeB6GS:r+UACrdGUjK/2on96aibddgzHiHeezsE
TLSH D9942368A11FA35A61DB89E41A1FFE767247EFD2747B5060F4E2850B722DD2CEF89004
Reporter abuse_ch
Tags:AgentTesla DHL z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl-news.com
Sending IP: 209.58.149.66
From: DHL Express Courier <support@dhl-news.com>
Subject: Emergency Situation Surcharge Update
Attachment: Emergency Situation Surcharge Update.PDF.z (contains "Emergency Situation Surcharge Update.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb698c48127fe0398c2ab555fb0c1b75cb35c4a538eca9324b5dac711ad0da1f/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-07-10 07:17:06 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xnuyysasp7qdtdbkwvk7wda3oxftlrffhdwksmsllwwhcgwq3ipq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z bb698c48127fe0398c2ab555fb0c1b75cb35c4a538eca9324b5dac711ad0da1f

(this sample)

AgentTesla

Executable exe 3f258d6b65fd6594bc19ac4f3825112f78043a3c112f7bf56dd40bec84750a1e

  
Dropping
MD5 4d7528ff3e3e634db83bdc55c56ac62a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f258d6b65fd6594bc19ac4f3825112f78043a3c112f7bf56dd40bec84750a1e

Comments