MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c234fed87620b10c12607ad80b7335a6b69c8e4ee043055e186ef5bfe3933fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c234fed87620b10c12607ad80b7335a6b69c8e4ee043055e186ef5bfe3933fd
SHA3-384 hash: 719f75bc23d6be8e95d53dd6a3bf6fa813f1eb58a510c2debb5b86f963afa2146c3c4a20f2ca010bbe97eeb909af465f
SHA1 hash: 5882cdb79fc0ef2b9d82faf14843f8bdb1ce3cf1
MD5 hash: 5542ad1aa3938c5dacba46c99f56b577
humanhash: whiskey-beer-october-ten
File name:INVOICE AWB_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:442'087 bytes
First seen:2020-05-08 07:01:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:R8GSK9yGkKQwvGZ2SDhn/z8CaF1C17hA3JCVxIL:R83GkgWlQCaF1evr+
TLSH E59423EDE0692EA97F5B1B303125884E597CB018C5D9BF288DE24CA9713FA16FDB1314
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.dls.co.id
Sending IP: 103.253.68.67
From: DHL | Express Shipping® <norepy.express@dhl.com>
Subject: Shipping Documents Invoice and AWB
Attachment: INVOICE AWB_pdf.zip (contains "INVOICE & AWB_pdf.exe")

AgentTesla SMTP exfil server:
mail.acroative.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Hploki
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 07:36:13 UTC
File Type:
Binary (Archive)
Extracted files:
65
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rqru73mhmifrbqjga6wybnztljvwtshe5ycdavpbq3xvx7rzgp6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8c234fed87620b10c12607ad80b7335a6b69c8e4ee043055e186ef5bfe3933fd

(this sample)

AgentTesla

Executable exe f3141eb0d06d4ddce695865bbd38b6d1c9fa564d3ab4a9f1a5d1c0bb9c9931cc

  
Dropping
MD5 d3c15d95b011a76871d3e2a21e86962d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f3141eb0d06d4ddce695865bbd38b6d1c9fa564d3ab4a9f1a5d1c0bb9c9931cc

Comments