MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef68a53ffaf7584413e01eaa584354da90ea48e10f531cff2b6f1a915bef52c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef68a53ffaf7584413e01eaa584354da90ea48e10f531cff2b6f1a915bef52c8
SHA3-384 hash: 5327cf7676a5fd61f4b88fa448cb58900e7676bede71b290eac9f6952f007df3611d5e11ea850b42c755dbf4ef4f9354
SHA1 hash: 48613a68781e3e16cec8afc8e4c420ce96f13efc
MD5 hash: 6a16c8788016ea2c8a1a9de6b6a3a0b7
humanhash: aspen-spring-juliet-triple
File name:shipping document.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:367'687 bytes
First seen:2020-06-25 14:27:54 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:YhUhTcqgldQ6HqUax9y+UpCBhKTmtgdKq+hugiGBN0iiWkUoIowWSw0Z0chvhm4L:Aw1gXQ6HnA9RUsBITmtgdwug7LY080Zd
TLSH D77423E0784D01FCE33791A0BDEBC314F16E219699E64B47B127DB184A191A286BEB71
Reporter abuse_ch
Tags:AgentTesla DHL z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: adobeequipment.com
Sending IP: 37.48.85.217
From: DHL Express <Service@adobeequipment.com>
Reply-To: Customer@dhl.com
Subject: DHL BILL OF LADING SHIPPING INVOICE DOCUMENTS
Attachment: shipping document.pdf.z (contains "shipping document.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef68a53ffaf7584413e01eaa584354da90ea48e10f531cff2b6f1a915bef52c8/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 14:29:04 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=55ukkp7265meie7ad2vfqq2u3kioushbb5jrz7zln4njcw7pklea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z ef68a53ffaf7584413e01eaa584354da90ea48e10f531cff2b6f1a915bef52c8

(this sample)

AgentTesla

Executable exe b4d253fd7bee0ac5be341956d6dcce635957111e207bfee5af0fa9067b066bcb

  
Dropping
MD5 fd3565eaa96e9357fa3cdf996c271f19
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4d253fd7bee0ac5be341956d6dcce635957111e207bfee5af0fa9067b066bcb

Comments