MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2bb015e854f37e72248b11888db6c15d7ae134ba60b409be46aff0f46c89571. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2bb015e854f37e72248b11888db6c15d7ae134ba60b409be46aff0f46c89571
SHA3-384 hash: 4eb62f9746076cbbda62648ad701fae2be196aa5bb6421eb387558f14d61d1f831b2a1145cb4da79819d7afba6309600
SHA1 hash: 41038061c3e8b9e38ae519c2187162860df2e052
MD5 hash: 83834653aa8881c5859b65d328f0f0fd
humanhash: connecticut-utah-grey-berlin
File name:DHL SHIPPING DOCUMENTS.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:391'521 bytes
First seen:2020-06-15 05:45:33 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:cUS6bB+4qxSrDV44DSseWSqR9PwNIGFvglcRehgHc4I8U9Jj5v9ks53fxlAQB:csE4KiD64DVSqEJYqogHvI8U9Jl9ksJv
TLSH 2C84236F07A70CF2788BA6712279076B489B43471B4200EA15B2DCC9D63E7B07D97E72
Reporter abuse_ch
Tags:7z AgentTesla DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-241-215-159.unifiedlayer.com
Sending IP: 162.241.215.159
From: DHL EXPRESS <Shital.Adecco@dhl.com>
Subject: Re: DHL SHIPMENT NOTIFICATION
Attachment: DHL SHIPPING DOCUMENTS.7z (contains "DHL SHIPPING DOCUMENTS.exe")

AgentTesla SMTP exfil server:
montana.co.ke:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:47:04 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2k5qcxufj436oisiwemirw3mcxl24e2luyfubg7enl7q6rwisvyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z d2bb015e854f37e72248b11888db6c15d7ae134ba60b409be46aff0f46c89571

(this sample)

AgentTesla

Executable exe de0bc48e2efc61427a301db89cf4c3497e235cc0ef388db3a26ba94ac734de69

  
Dropping
MD5 e23e136aa369ed40337780e8412de097
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de0bc48e2efc61427a301db89cf4c3497e235cc0ef388db3a26ba94ac734de69

Comments