MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c692439a5a738b952e7be310e3fbf90a3d965b73f8b3c445ea1243d4ad79056. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c692439a5a738b952e7be310e3fbf90a3d965b73f8b3c445ea1243d4ad79056
SHA3-384 hash: d9227fff8d7b3bee2e27599e4e756da713c1e282829cf45df3a58497dff28f2a19fec4b3d5197474b7d5866699bb5d58
SHA1 hash: 5c45f33811bc44102b5aa8e4f49ad90c40c6bbc9
MD5 hash: 9559870734e924226ecd7c678c361bb3
humanhash: tennessee-ceiling-indigo-rugby
File name:DHL-AWB130501923096.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:382'486 bytes
First seen:2020-07-21 06:33:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Ie94Woj9Odt3r/nsDmJbsoN5YwIIoXe+JhdMCiQekQwda69i8gSGwFpEJg7iFd2c:9EYtjsDmJwoNPhezhd9Q8i8gSGwkKw0c
TLSH 01842338E848D13534D9179DEACE45AFD81331B00ACA64818ED7A607CD366FE9DB64B3
Reporter abuse_ch
Tags:AgentTesla CHN DHL geo z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 95.211.208.57
From: "DHL快递中国" <dispatch@dhl.com>
Subject: 由于发货地址错误而退回发货 - DHL-#AWB130501923096
Attachment: DHL-AWB130501923096.pdf.z (contains "DHL-#AWB130501923096.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23268.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c692439a5a738b952e7be310e3fbf90a3d965b73f8b3c445ea1243d4ad79056/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:35:07 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=frusionfu44lsuxhxyyq4p57scr5sznxh6ftyrc6uesd2swxsbla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c692439a5a738b952e7be310e3fbf90a3d965b73f8b3c445ea1243d4ad79056

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2c692439a5a738b952e7be310e3fbf90a3d965b73f8b3c445ea1243d4ad79056

(this sample)

AgentTesla

Executable exe 3f7417d4b9f49c910340aa5797f17cb9899543411e476aaca96fa314ee4d5397

  
Dropping
MD5 6b880b358309ffcf258d03fd9fd1b161
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f7417d4b9f49c910340aa5797f17cb9899543411e476aaca96fa314ee4d5397

Comments