MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccae590127d9d4c031f8996e4bf7361e14c15d80a77d8759e5c290a44092b748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccae590127d9d4c031f8996e4bf7361e14c15d80a77d8759e5c290a44092b748
SHA3-384 hash: 6adf971d92c01b7c37757cb90718bc25978c3cb61eee5793983c86de01e8a8d8a5dd4dd1d64e091ad3c76f3792e79eca
SHA1 hash: 6227b698900871a5413b46f398cb7090de93d45d
MD5 hash: bdd300551c55947472179eb56f27ffec
humanhash: spaghetti-oxygen-aspen-emma
File name:Shipmet_Documents_DHL_AWB 7849402748,pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:4'155'724 bytes
First seen:2020-07-13 06:59:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:cRbP+NWrJRGjPJ3eRYbQQKy0FqD+4kEl+R2mXv:o7+qYORYvKyRDRtG/
TLSH 65163331A76C3B44AD86AD0542DCFF2F309284C35CBD5168E3A1C9659FCA6DBD912FA0
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-751187.hostwindsdns.com
Sending IP: 104.168.202.68
From: DHL CUSTOMER SUPPORT <no_reply@dhl.com>
Subject: Shipment Notification AWB Number: 7348255141
Attachment: Shipmet_Documents_DHL_AWB 7849402748,pdf.zip (contains "Shipmet_Documents_DHL_AWB #7849402748,pdf.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccae590127d9d4c031f8996e4bf7361e14c15d80a77d8759e5c290a44092b748/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 07:01:05 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zsxfsajh3hkmampytfxex5zwdykmcxmau56yowpfykikiqesw5ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ccae590127d9d4c031f8996e4bf7361e14c15d80a77d8759e5c290a44092b748

(this sample)

AgentTesla

Executable exe 4feb056769f2ac7fb07a65bfd3d5ca0fc22e8f3b3cf046fc586c782935ca2445

  
Dropping
MD5 7130e2694cca996709191b76808eef93
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4feb056769f2ac7fb07a65bfd3d5ca0fc22e8f3b3cf046fc586c782935ca2445

Comments