MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ff997acf2859ca26b2f8aa2a5b91db215fe0d66d0ec97a118b6a3df5da4c5f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ff997acf2859ca26b2f8aa2a5b91db215fe0d66d0ec97a118b6a3df5da4c5f6
SHA3-384 hash: c9f0d3c4ed43477a87d607d9f46a60960bbe83a918f8e1b6272306dd976e5752a5eb2233a8793432edc70f751b0867f6
SHA1 hash: b4d31b06f3c8d1d4627a848ecd453fc171a22db1
MD5 hash: 8ca06d9b96c0880f4de607ef08d239c1
humanhash: mars-three-mike-blue
File name:Delivery Note AWD-20039383839-383736833.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:690'045 bytes
First seen:2020-07-08 06:34:01 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:qxI4RtdJbZu/F4B7RWJbYDC+ykeOTQshaqd/nKcfLQc9T478yTgUxVkz1nY:ITju/F4GJb0C+WOTQ1SScxCxszdY
TLSH 6DE42343838B19AC57213A5E533CE5AC3B5C487EAD1A697D7A28BF1A9840F40F7D0279
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.manisanet.net
Sending IP: 89.252.178.16
From: DHL Express <katewright_dhl@gmail.com>
Subject: Failed DHL Delivery Notification
Attachment: Delivery Note AWD-20039383839-383736833.gz (contains "Delivery Note AWD-20039383839-383736833.exe")

AgentTesla FTP exfil server:
ftp.southeating.com:21

AgentTesla FTP exfil user name:
aridon@southeating.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.378.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ff997acf2859ca26b2f8aa2a5b91db215fe0d66d0ec97a118b6a3df5da4c5f6/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 06:35:04 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b74zplhsqwoke2zprkrkloi5wik74dlg2dwjpiiyw2r56xneyx3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0ff997acf2859ca26b2f8aa2a5b91db215fe0d66d0ec97a118b6a3df5da4c5f6

(this sample)

AgentTesla

Executable exe 4067a43c3518dd21e937615d4d05115eeb11a15691ebb1197222221b5cdf9e9d

  
Dropping
MD5 29ab7a6bfebc276d50f9d6933616229c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4067a43c3518dd21e937615d4d05115eeb11a15691ebb1197222221b5cdf9e9d

Comments