MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8075f8050a62b6e8c8f3e7ad7d8305a793cd360f4f4ee16ca7d62b8765a64c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8075f8050a62b6e8c8f3e7ad7d8305a793cd360f4f4ee16ca7d62b8765a64c8
SHA3-384 hash: 8a9fb93be2df8ae4dfa248a678b9454d3a3972d370dc43a44ea152fc5e469c1747200ebaebfe0c76d25d180446b6e1ee
SHA1 hash: 6fd9cef9299a5c835d757dc1ef7f1a57df2da9d0
MD5 hash: ce1ba9558406475e1da7f10d81e34607
humanhash: princess-carpet-autumn-victor
File name:ShippingDocument..zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'999 bytes
First seen:2020-05-11 08:55:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:7rgsG6STc5LSZ6mvwaAmZngUWmgb1XSrEpZc:7rgvRaLSZ6QLbZ9GErwe
TLSH 3AA4238251F0BD65CA43907F97C4294C9E78F69B11F3BE9CC2666488A2C3C91F9DC788
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.macartajans.com
Sending IP: 89.252.130.69
From: DHL | Express Shipping <DHLEXPRESS.BILLINGID@dhl.com>
Reply-To: DHL | Express <customerupdat013489@gmail.com>
Subject: Re: Shipment Notification (2nd Reminder)
Attachment: ShippingDocument..zip (contains "ShippingDocument..exe")

AgentTesla SMTP exfil server:
mail.acroative.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Artemis85EBAC484AE7.32433.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Hploki
Create hunting rule
Status:
Malicious
First seen:
2020-05-10 23:06:53 UTC
File Type:
Binary (Archive)
Extracted files:
396
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3adv7acquyvw5dephz5npwbqlj4tzu3a6t2o4fwkpvrlq5s2mtea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d8075f8050a62b6e8c8f3e7ad7d8305a793cd360f4f4ee16ca7d62b8765a64c8

(this sample)

AgentTesla

Executable exe 69743cf570a9635bebdf3c89b4ad7c6824efac3c2c3ee33577177fb7954848a6

  
Dropping
MD5 ec3d4810e05a3b1006184365634aa603
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 69743cf570a9635bebdf3c89b4ad7c6824efac3c2c3ee33577177fb7954848a6

Comments