MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67f09620791df066f5a93e1d231fd695f6519a8f1de29c58dae8a2ab576c5caa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67f09620791df066f5a93e1d231fd695f6519a8f1de29c58dae8a2ab576c5caa
SHA3-384 hash: 2263e7f1c301685a0007428bcb5672f22f317b0fa46f435fbf0b0186dadc55a4e54150668e4267dc3f84d1c4550957c4
SHA1 hash: 25ad96b1c294505b00b8e14e9993817baf984ebe
MD5 hash: eff9fcbfda6f95b4180497693fd31212
humanhash: stairway-ack-michigan-winner
File name:Delivery Note - AWD 200038485852- 2349203998800.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:472'684 bytes
First seen:2020-06-08 12:37:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:LqxvMmGgznhIR+jM7AWAe0IGT4g0M8lN0PMLVkM9rHKjK+zEoPZx29jh7tyMDJkh:mxv0MnhE+6SIMGM80kRSK+zEw+DJ/s
TLSH D6A4330D13D883AFE5A512C41F8D850BAEE5831E5C9F752F53E04FAB4D291CB650AACE
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns7.apdevs.com
Sending IP: 192.99.215.59
From: Dhl Express <ewout.blaauw@dhl.com>
Subject: DHL Delivery Notification
Attachment: Delivery Note - AWD 200038485852- 2349203998800.zip (contains "Delivery Note - AWD 200038485852- 2349203998800.exe")

AgentTesla FTP exfil server:
ftp.persisiciptautama.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.AI.Packer.46E09C1421.12572.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25251.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:39:08 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m7yjmidzdxygn5njhyosgh6wsx3fdgupdxrjywg25crkwv3mlsva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 67f09620791df066f5a93e1d231fd695f6519a8f1de29c58dae8a2ab576c5caa

(this sample)

AgentTesla

Executable exe f1cb2240eab8c2a7807b5a2b3c9b8f8320d88d7ec5a75dc28280fa5522e8e35a

  
Dropping
MD5 b90d8527711ed8987eba17691430204f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1cb2240eab8c2a7807b5a2b3c9b8f8320d88d7ec5a75dc28280fa5522e8e35a

Comments