MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88fafa1838ec8bb78fb542e0a27d7a22f266c4854f3dbb2b5911e40415204ec4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88fafa1838ec8bb78fb542e0a27d7a22f266c4854f3dbb2b5911e40415204ec4
SHA3-384 hash: 2f41895bff966cada836731a5b9c61bf11bfcaeccd24b2a17d2b5992294290b8c2c7b23240ad842b17c8b44094a79f17
SHA1 hash: 9e9b007732fe708384d715f8818bd71447b021d5
MD5 hash: e5cf2d951b0ea4add8dce76675bf6292
humanhash: leopard-carbon-earth-blossom
File name:SHIPPING DOCUMENTS.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:371'262 bytes
First seen:2020-06-20 06:12:15 UTC
Last seen:Never
File type: ace
MIME type:application/x-rar
ssdeep 6144:coeQHg99tyR0fchzV7s122pZhTBdugu3dD1/brcntv0hPueVydC8W9fHN5t8ayr:TeQHgQnG1R9ObgBIVMwheLr
TLSH 3C84237E73DA5CDFC24DE8BC68E58C553E2FCA556FB6603008D92DCB046849DC049EAA
Reporter abuse_ch
Tags:ace AgentTesla DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns50.hostingspeed.net
Sending IP: 202.74.40.53
From: DHL EXPRESS <noreply@dhl.com>
Subject: RE: SHIPPING DOCUMENTS
Attachment: SHIPPING DOCUMENTS.ace (contains "SHIPPING DOCUMENTS.exe")

AgentTesla SMTP exfil server:
mail.barakadestinations.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 06:14:04 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rd5pugby5sf3pd5vilqke7l2elzgnrefj463wk2zchsaifjaj3ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 88fafa1838ec8bb78fb542e0a27d7a22f266c4854f3dbb2b5911e40415204ec4

(this sample)

AgentTesla

Executable exe fb21fea4253258e56da254f5f1009be32ca3b49f2c8dbf617188e9f0afe127d3

  
Dropping
MD5 3b193396b18fbfcca64fb718a1e94d61
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fb21fea4253258e56da254f5f1009be32ca3b49f2c8dbf617188e9f0afe127d3

Comments