MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6130d160b57a3de1e6d5d21d16966129e966ce68a189174efcb5551317b34bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6130d160b57a3de1e6d5d21d16966129e966ce68a189174efcb5551317b34bc
SHA3-384 hash: fe6e6a1437b8c119c09fb23807d9fb80e78d6263e3fe9fc117ee75c465d92e646f47942f2ac06a297384903f40f72b07
SHA1 hash: c86f73ab5bbd4708f2f7adffededadf0a0c8daba
MD5 hash: 83271d4962d0c3a0d2a9612b03273183
humanhash: zulu-seventeen-william-twelve
File name:dhl_doc7348255141.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:934'756 bytes
First seen:2020-06-08 12:38:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:hB2jMXoWpz7cihnlz9r2KZyRo8qpX7J3OYJoCtXXWR:z2Hkz1NlzIKMe8u7J3OnLR
TLSH 27152398F4C87FA79AAC418A0141FC3A7BF90B06DB3E1D0E854D5632FB1F8964919237
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: track.easyandweb.com
Sending IP: 137.74.191.59
From: DHL Express <support@dhl.com>
Subject: DHL Shipment Notification : 7348255141
Attachment: dhl_doc7348255141.zip (contains "dhl_doc7348255141.exe")

AgentTesla SMTP exfil server:
smtp.waltartosto.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:40:05 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2yjq2fqlk6r54htnluq5c2lgckpjm3hgrimjc5hpznkvcml3gs6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d6130d160b57a3de1e6d5d21d16966129e966ce68a189174efcb5551317b34bc

(this sample)

AgentTesla

Executable exe 65af15b11856d21689e9802922fb393c3eafaef2e05724f7af5ecd99c8db6c37

  
Dropping
MD5 0445861e3e7013992c7d3c8387f40bf8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 65af15b11856d21689e9802922fb393c3eafaef2e05724f7af5ecd99c8db6c37

Comments