MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68f166dc8c1eed605bb95b2c5f3699212d7f50dd60fa64365c413e92699c3049. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68f166dc8c1eed605bb95b2c5f3699212d7f50dd60fa64365c413e92699c3049
SHA3-384 hash: 2e616d7bc6a5b06d461e10c2c359d34213f872109ad4bf4ec977b5d6f40cc5762828fcb55cf49e79c589021d409f0bcb
SHA1 hash: cd05b8999bb367f11f77a435933a51e40dfbffbb
MD5 hash: 750f107aea231d0fed5e4c9b2513d371
humanhash: eighteen-fillet-blossom-eleven
File name:DHL_DELIVERY_PACKAGE.pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:346'999 bytes
First seen:2020-05-13 11:11:28 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:C0ekXJr0re8xbuGavXUWnOiqTbnYVVHDbaGAwirTBxFW/ESc7uD/UPDs:peU6re8xaRUWnEYLHnaGAw2nFdL9Ls
TLSH A574230B279E4E163C868D9497F8EF658BDD2BD4D1F1A7632183B509520B2E865FCEC0
Reporter abuse_ch
Tags:7z AgentTesla DHL geo ROU


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.linux99.papaki.gr
Sending IP: 78.46.83.231
From: DHLEXPRESS <DHLexpress@protege.ro>
Subject: Documente de livrare DHL - Număr AWB: 7593461 ****
Attachment: DHL_DELIVERY_PACKAGE.pdf.7z (contains "DHL_DELIVERY_PACKAGE.pdf.exe")

AgentTesla FTP exfil server:
ftp.vilaursutismana.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 11:37:04 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ndywnxemd3wwaw5zlmwf6nuzeewx6ug5md5gins4ie7je2m4gbeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 68f166dc8c1eed605bb95b2c5f3699212d7f50dd60fa64365c413e92699c3049

(this sample)

AgentTesla

Executable exe 6409af3cf3a80e1fb1ec7fb0589e05de82d4f4d93ea582b77a187bd941a4cf06

  
Dropping
MD5 338d78c6464e6972c436f036e4dd04cf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6409af3cf3a80e1fb1ec7fb0589e05de82d4f4d93ea582b77a187bd941a4cf06

Comments