MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de5174183d8e0a29d17e12126616a392bc38d150fd954c9e4a1ee20bf245245a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de5174183d8e0a29d17e12126616a392bc38d150fd954c9e4a1ee20bf245245a
SHA3-384 hash: c76f1dcc44db56d3dd827480ab0df2e1547652295ea9d60127b3cb60c81667ffc0e2eedace154b964041b7895ab53659
SHA1 hash: b610711ca626022661c015237661e33670ac8098
MD5 hash: 48c81f687a28b1c0c7077595496e2b62
humanhash: kitten-video-salami-lactose
File name:Shipping Details 00459010265 - 07.07.2020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:616'895 bytes
First seen:2020-07-09 07:11:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:XmwjZgPILSl10CUThp0lY73AHCWxS55cFCfI4iedi:2wjZ4ILSfHUThp/73Cc5RfI4fQ
TLSH 57D4236599F7E91A03380A371996113F00C153A644255EA83BF19CFFFCF81E6B6BE189
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: www.ncl.co.id
Sending IP: 103.43.46.80
From: DHL EXPRESS <consignment.notification@dhl.com>
Subject: RE: DHL: Package arrival notification
Attachment: Shipping Details 00459010265 - 07.07.2020.zip (contains "Shipping Details 00459010265 - 07.07.2020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENWJ.22777.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de5174183d8e0a29d17e12126616a392bc38d150fd954c9e4a1ee20bf245245a/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 07:13:04 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3zixigb5ryfctul6cijgmfvdsk6drukq7wkuzhskd3rax4sferna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip de5174183d8e0a29d17e12126616a392bc38d150fd954c9e4a1ee20bf245245a

(this sample)

AgentTesla

Executable exe ad2da1fa0e285bd992c7dc1d0dcad3f5a476bd62478ebf958326302942fabeec

  
Dropping
MD5 ec25c93cf619cf346cbb955af0518baf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad2da1fa0e285bd992c7dc1d0dcad3f5a476bd62478ebf958326302942fabeec

Comments