MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62b7c49dd5e56ed2ef207e9c4b72c06bb0e59dfcc1d93ff9faf6c3229ae468af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62b7c49dd5e56ed2ef207e9c4b72c06bb0e59dfcc1d93ff9faf6c3229ae468af
SHA3-384 hash: 325f6a39b63925d201adcf6510cf3c9b05d8b7d3712febb660190bc5ea69586be7729f4f117915d8d13af57cad7bf824
SHA1 hash: b49fe30081da31813445141547b949eb2be50afb
MD5 hash: b0cfa08ff939050b2e2e8f91f29e8b5b
humanhash: ack-salami-vegan-glucose
File name:Shipping Document PLBL Draft Copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:564'815 bytes
First seen:2020-10-20 08:40:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:mNrUb6P4hRNj1WFmKCmZamjc57hwjmyrSsrlX4p6Bh047Kz:n6PSRNjcmKCnmcqqUSII6Bh97Kz
TLSH C6C4230EF517737099A285EC3C395A34C148FB424DD9C5EF489E80A790BB5B67312BAE
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: winmedicare.com
Sending IP: 95.211.253.203
From: Clare Liddiard (DHL) <sudeep.goel@winmedicare.com>
Subject: Consignment Notification: You Have A Package With Us
Attachment: Shipping Document PLBL Draft Copy.zip (contains "Shipping Document PL&BL Draft Copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62b7c49dd5e56ed2ef207e9c4b72c06bb0e59dfcc1d93ff9faf6c3229ae468af/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 00:27:53 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mk34jhov4vxnf3zap2oew4wanoyolhp4yhmt76p263bsfgxencxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62b7c49dd5e56ed2ef207e9c4b72c06bb0e59dfcc1d93ff9faf6c3229ae468af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 62b7c49dd5e56ed2ef207e9c4b72c06bb0e59dfcc1d93ff9faf6c3229ae468af

(this sample)

AgentTesla

Executable exe 312b49a82f8571c6c85b8322115dd46980e9005010c8e3c1d2fa27b0cb1ff0a5

  
Dropping
MD5 c351248da0db7003c219d1d98fd729e6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 312b49a82f8571c6c85b8322115dd46980e9005010c8e3c1d2fa27b0cb1ff0a5

Comments