MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca7502f7db7a852018d850ead75d573e38abde7a26abf953be5b374e13fa6a89. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca7502f7db7a852018d850ead75d573e38abde7a26abf953be5b374e13fa6a89
SHA3-384 hash: 0cdb745cee895f03954943469ecc394d1a46d1e49c91a594a2dccc434d4ddd22e8e73913c0733b3018f423aad247e3e2
SHA1 hash: c226b53797adbac146029f7651de1a401d0e9b8c
MD5 hash: d685577b526863835eb708a454319382
humanhash: foxtrot-network-bacon-music
File name:DHL-Invoice.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:536'334 bytes
First seen:2020-04-29 18:39:11 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:gY0W3yKEh2JQFCGDICaDnLnEtWCpCBPB+FT+xBY7/RT2mUHO/:z0WDH+ZDaHKwBQFywRT/UHO/
TLSH AFB42347AB143EFC4AB03789989E207FF0248D41FEE274A6C44ED0D159A66F89217FB5
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: redsox.unisonplatform.com
Sending IP: 162.219.250.42
From: DHL GLOBAL FORWARDING <trackingmail@dhl.com>
Subject: Your DHL Shipment/Package Delivery AWB:8051195810
Attachment: DHL-Invoice.gz (contains "gunzipped")

AgentTesla SMTP exfil server:
smtp.znshenesolar.com:587

AgentTesla SMTP exfil email address:
alexqian@znshenesolar.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 12:37:20 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zj2qf563pkcsaggykdvnoxkxhy4kxxt2e2v7su56lm3u4e72nkeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ca7502f7db7a852018d850ead75d573e38abde7a26abf953be5b374e13fa6a89

(this sample)

AgentTesla

Executable exe e9562d459a5cbfba49f7b039b3cc7758fcf4aeee2676943547dd6df31a61c7a8

  
Dropping
MD5 57b5d61e38227cf6dec41a8503fb891e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e9562d459a5cbfba49f7b039b3cc7758fcf4aeee2676943547dd6df31a61c7a8

Comments