MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d327ccadf89d14e93127915bb29961a29525767a4d0d44d848babe602def69aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d327ccadf89d14e93127915bb29961a29525767a4d0d44d848babe602def69aa
SHA3-384 hash: f4ae59f4ff060429f021c2ad58921fbcc929aeeb18b49c9650bd5276208c4290efadd789f990b652c844415d1ac213a5
SHA1 hash: f7b65eda1e210d67a77205994a16c23dc4ab1003
MD5 hash: e79bbb062b8ea8f540c20f99f585d1e3
humanhash: august-don-hydrogen-crazy
File name:Shipping Documents.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:397'950 bytes
First seen:2020-05-27 17:58:52 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:ssEQ8mxfeaWZ5qeVXZAE5ipf55fYenL3TVUFRPK:JEsFXWdY55genL3T2FRS
TLSH 868423EC4A543A878EF4FBF96CC090F464C62594BB2AE7115B30522837CEBD1976718E
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mstdlrgw.mst-dealer.com
Sending IP: 203.146.21.245
From: K.M. Mustafizur Rahman <csd-a420@mst-dealer.com>
Subject: Re: Shipping Documents / Order NO: ANT13O5951B
Attachment: Shipping Documents.gz (contains "Shipping Documents.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 03:58:01 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz d327ccadf89d14e93127915bb29961a29525767a4d0d44d848babe602def69aa

(this sample)

AgentTesla

Executable exe ac6e5dcfea294b4260a82eea6cb2de75eecb7d960f3797163aaaecfd9c95d380

  
Dropping
MD5 afcf124a6f90e2fb779f2bd83c243667
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ac6e5dcfea294b4260a82eea6cb2de75eecb7d960f3797163aaaecfd9c95d380

Comments