MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78b7a3fa18d216581743e53c0e9104e4c687521b1298eeb4214df32fffdbc24b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78b7a3fa18d216581743e53c0e9104e4c687521b1298eeb4214df32fffdbc24b
SHA3-384 hash: f5b3998cb4cb49d97f8a57c9ee299bf4e83007659a978440b6ca5095ed5b3e8150d7959575568b1ffadb13e41dc63a6f
SHA1 hash: fec6f5563a33495b427f68ca19f43e0ba5966aa4
MD5 hash: d9ee035741332564de54ecac4d2ed8f5
humanhash: batman-west-table-butter
File name:INV-AWB-COPY65688563423470.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:392'595 bytes
First seen:2020-06-29 06:40:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:WsnYCDIC13mx4axKwOEIL2EMgGyPNEIgK19CnaO7ZUI4C0L8+i5Op6wS0+:WsYCUuk4aQZEIiDI1IyS0L8+i5Op6wSZ
TLSH B7842312D146162B47E71E714E2DA283B49BF8E03C46F850D30B6161E6EB489E1BFB77
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 209.58.149.66
From: DHL EXPRESS <dhlexpress@dhl.com>
Reply-To: jhwang.allmedicus@gmail.com
Subject: SHIPMENT NOTIFICATION
Attachment: INV-AWB-COPY65688563423470.pdf.zip (contains "INV-AWB-COPY#65688563423470.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FVR97B1CDB35EA0.28661.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78b7a3fa18d216581743e53c0e9104e4c687521b1298eeb4214df32fffdbc24b/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 01:37:45 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pc32h6qy2ilfqf2d4u6a5eie4tdiouq3ckmo5nbbjxzs7763yjfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 78b7a3fa18d216581743e53c0e9104e4c687521b1298eeb4214df32fffdbc24b

(this sample)

AgentTesla

Executable exe 83050c83ab71af263003fba66c14fd917289e0690a7c645a831a7626cd9f1061

  
Dropping
MD5 708fd3fb156db922483590981604841d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 83050c83ab71af263003fba66c14fd917289e0690a7c645a831a7626cd9f1061

Comments