MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff306b70fef8b41684e422c21181132067941575d5dc3f426bc66377b10c2714. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff306b70fef8b41684e422c21181132067941575d5dc3f426bc66377b10c2714
SHA3-384 hash: a1e9a040d8c2078d024a65af204cb54bd108cb3040f0dbb918fcecef6b63e7d6cb93e31fe7949e7ef7a60468f2265e04
SHA1 hash: 3add8d938839c5a7fdf5fb8c997ec6a832f94486
MD5 hash: d95e3c10f4b462fe87607e4ced93ba65
humanhash: kentucky-cat-uniform-earth
File name:DHL AWB7849402748.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:428'575 bytes
First seen:2020-06-25 13:08:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ZqMGg0ScZbMDSGqTiGqD6UP08K6P4jj8iTHKias2WW3k1HdlS8d4q9mJ6ZYXVSF7:ZqgiV21qTix6apJ4jjBKJe0qBd4DVVA
TLSH 4D9423B87C43E27CF34EB4596A857D126C1BD301CB802FE6434EE04FFD94AA4599671A
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ml.keonig-bauer.com
Sending IP: 85.92.108.199
From: DHL CUSTOMER SUPPORT<support@dhl.com>
Subject: Shipment Notification AWB Number: 7849402748
Attachment: DHL AWB7849402748.zip (contains "DHL AWB#7849402748.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.348.9979.17414.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff306b70fef8b41684e422c21181132067941575d5dc3f426bc66377b10c2714/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 13:38:10 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=74ygw4h67c2bnbheelbbdaitebtziflv2xod6qtlyzrxpmime4ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ff306b70fef8b41684e422c21181132067941575d5dc3f426bc66377b10c2714

(this sample)

AgentTesla

Executable exe 1304d571397e1775ddd4c26d86e529f0f9ca99a462639bb471c6dd686a11a18d

  
Dropping
MD5 cb4be437f5cb56f10388785484d133c6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1304d571397e1775ddd4c26d86e529f0f9ca99a462639bb471c6dd686a11a18d

Comments