MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5532d8db9d03a31003691d98ad4acc00c159cbab6d76f4e66c147d634efd8894. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5532d8db9d03a31003691d98ad4acc00c159cbab6d76f4e66c147d634efd8894
SHA3-384 hash: 5cd1df929ee18332a5c3ad096de4e1e0b4948bb0e6471f358bfa5f44ebdaa9062b60728c45f5d5881f38b7f02d40a295
SHA1 hash: 62db48d1320252bbb0e2034ac361c0edbf0ed216
MD5 hash: c05d2d3b1755187051b979a8f3eb084f
humanhash: floor-shade-washington-sixteen
File name:DHL Form2.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'029'843 bytes
First seen:2020-08-30 06:30:38 UTC
Last seen:2020-08-30 06:32:45 UTC
File type: zip
MIME type:application/zip
ssdeep 49152:O8WOIT7QgU+FwTrYvCFXVjR1vF/eFqa6fzELXzdFgf5aSk//:DWOITEgXmTs6dVjvFyGOJCf5pS
TLSH F49533BDBEC01BD46A2680147B03DB676D33C10DECCF98564716A18DFD160B8EAAD69C
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mta1.donyc3.chereemail.com
Sending IP: 134.209.43.91
From: DHL Customer Support <dhlexpress@webemailoffice.com>
Subject: DHL Shipment Notification
Attachment: DHL Form2.zip (contains "DHL Form.exe")

AgentTesla SMTP exfil server:
smtp.bestbirdss.com:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5532d8db9d03a31003691d98ad4acc00c159cbab6d76f4e66c147d634efd8894/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Suspicious
First seen:
2020-08-29 11:06:57 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kuznrw45aorraa3jdwmk2swmadavts5lnv3pjztmcr6wgtx5rcka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5532d8db9d03a31003691d98ad4acc00c159cbab6d76f4e66c147d634efd8894

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5532d8db9d03a31003691d98ad4acc00c159cbab6d76f4e66c147d634efd8894

(this sample)

AgentTesla

Executable exe 34389c63bfec9402befc3afc4d92259a43056b33d6e4b70054d50ba38d258981

  
Dropping
MD5 52ab6e6935088ad3841911caa1ea67fe
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34389c63bfec9402befc3afc4d92259a43056b33d6e4b70054d50ba38d258981
  
Dropping
SHA256 f76e9e0cf7e0349e1ce870be3149b42f1ab21305fab062398a6d2e360f699743
  
Dropping
MD5 16bbcfbb083076e25b83686dc8e7d6f0
  
Dropping
SHA256 df68e151234024e309edd6285be6afa2ac21b30fa660f3aefe4417b17ab27400
  
Dropping
MD5 1ec280888c4ab7f40752bd3fee29fece

Comments