MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 267b93097cbaa374381a4f3cdfdc97bde0e75ec28bcbcfb27c62d4cd7e136c8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 267b93097cbaa374381a4f3cdfdc97bde0e75ec28bcbcfb27c62d4cd7e136c8b
SHA3-384 hash: 6d9674cab449f21eff50e13068e3f37d6c6ac164a38433a9536bb28b97ae588a730a811dcb5768b6975dcdf8a758c2ee
SHA1 hash: a99afef018204ed0f483d684873ddda6a43092c2
MD5 hash: f70ce35016ac2b9cf6743fe38ea26e6f
humanhash: summer-leopard-oranges-mississippi
File name:Shipment Airway Bill_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'076 bytes
First seen:2020-06-03 11:48:49 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:258K76rZCtxPb88a7k4Y1bN3SgVYS+nB1lOjWh:2DWrZCbbBj33SgVw1lkWh
TLSH 22A423235671E572C94613EA8F097D6AD333011BA93267E0B9CB2B2774747C930D1EBA
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.vinylbannersprinting.co.uk
Sending IP: 217.174.249.10
From: DHL EXPRESS <worldwide@dhl.com>
Subject: DHL Express shipment per-alert!!
Attachment: Shipment Airway Bill_pdf.gz (contains "gunzipped")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 12:36:08 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ez5zgcl4xkrxioa2j46n7xexxxqooxwcrpf47mt4mlkm27qtnsfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 267b93097cbaa374381a4f3cdfdc97bde0e75ec28bcbcfb27c62d4cd7e136c8b

(this sample)

AgentTesla

Executable exe b3a27e158356620e607a47b1ec0ba508a7526d6dcda53de87a40f0e9c5397cc2

  
Dropping
MD5 a85f75089b8bbc003affac7ae960e5c8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3a27e158356620e607a47b1ec0ba508a7526d6dcda53de87a40f0e9c5397cc2

Comments