MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66786bb5a7e60e045544d902af3491d2f1af6356b582057e6abc7c3c8abfbe52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66786bb5a7e60e045544d902af3491d2f1af6356b582057e6abc7c3c8abfbe52
SHA3-384 hash: 0420bf25a36f64279eb3e0d7f288ae6f97536cce825d68c6ee6855a89fb6e63d2a09250386e812ac631de954770982f4
SHA1 hash: 6c8e6ace70c87dcf2dc383da903b3bef8a57723b
MD5 hash: b499e2945050901ae5e008f71c978ebe
humanhash: minnesota-batman-coffee-freddie
File name:dhl_doc8532967438.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:373'906 bytes
First seen:2020-07-03 06:42:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:UrQ1qsSBjkdCoRAKhgaW4DTegSJDbq0bzWxpYJhyt13LqAWfeKjC19cynbaxXBXU:Rq1sCYAKCQXegGD3Seh+aXCbcyn6E
TLSH 3084232D0ABC44BBA7941AF57AEDB39EF19678280EE53B3EE5B380C850447415F03676
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: or.orgocarapi.live
Sending IP: 45.95.171.99
From: DHL Courier <No_reply@postdhl.com>
Reply-To: No_reply@postdhl.com
Subject: DHL Shipment Notification : 8532967438
Attachment: dhl_doc8532967438.zip (contains "AWB RECEIPT.exe")

AgentTesla SMTP exfil server:
smtp.usamilitarydept.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66786bb5a7e60e045544d902af3491d2f1af6356b582057e6abc7c3c8abfbe52/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:44:04 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mz4gxnnh4yhaivke3ebk6ner2ly26y2wwwbak7tkxr6dzcv7xzja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 66786bb5a7e60e045544d902af3491d2f1af6356b582057e6abc7c3c8abfbe52

(this sample)

AgentTesla

Executable exe 7a994f27238df40178431508778e3a655cf73c5fac2d1d7166cb77c71c7b5710

  
Dropping
MD5 a40a3af68891c5a96f112fffefd8fb41
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a994f27238df40178431508778e3a655cf73c5fac2d1d7166cb77c71c7b5710

Comments