MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69b391e73ae006561e19d7cf9d5d318e5aeac7a45a5b7cf3f2af9e68ec0e7320. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69b391e73ae006561e19d7cf9d5d318e5aeac7a45a5b7cf3f2af9e68ec0e7320
SHA3-384 hash: 542d84ceb6520dfe4f956ff9028ae16f46fbe6604b0d157f36350fad49f20431300dec19231ac38a2cd07e3337600c98
SHA1 hash: a91f59c0382e93bf7cb0acfc19461042de8b2850
MD5 hash: b7aa9adfdf1871e0a3ae7f1b1718c7c6
humanhash: chicken-hydrogen-high-bravo
File name:HBL RECISED T2020.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:651'142 bytes
First seen:2020-08-31 05:53:16 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:DvpbeDKvkWvOahCSb9wq7szX0n3ZBmQ/yv5C2RQO9OGhxOdfxI:DvBzvkW2FSqJzvY2Rky+f2
TLSH 54D42358B7A19D53F13423279EE5E01EBA6013B348D9E78E98A585D0FF04E3E17C54AC
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: liontrans2016.com
Sending IP: 45.137.22.90
From: "Araya <araya"@liontrans2016.com
Subject: Re: AW: AW: AW: Re: New Shipment // shipping Documents
Attachment: HBL RECISED T2020.gz (contains "HBL RECISED T2020.exe")

AgentTesla SMTP exfil server:
mail.hybridgroupco.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69b391e73ae006561e19d7cf9d5d318e5aeac7a45a5b7cf3f2af9e68ec0e7320/
Threat name:
Win32.Trojan.DelfInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 00:27:04 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/69b391e73ae006561e19d7cf9d5d318e5aeac7a45a5b7cf3f2af9e68ec0e7320

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 69b391e73ae006561e19d7cf9d5d318e5aeac7a45a5b7cf3f2af9e68ec0e7320

(this sample)

AgentTesla

Executable exe 38de2a27f6860ff3215434f3088f37ffc36c3a487fbfcee619bd1af281883624

  
Dropping
MD5 717e2c6415033786b29661192bbaf88e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38de2a27f6860ff3215434f3088f37ffc36c3a487fbfcee619bd1af281883624

Comments