MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ecfb7c43339ee2a1fb0c6e4b124803a56c5982ccbf8073e3b17e1c3452105b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ecfb7c43339ee2a1fb0c6e4b124803a56c5982ccbf8073e3b17e1c3452105b6
SHA3-384 hash: fa7800ba4675e6be6870dd8ec3fc9201882e972a2e12a50bd30844fb3e243cf1c90e5f4384ecf6bebb8b3dd57a4ff06e
SHA1 hash: 2352cd25286c10ce8d782d7b9735424bd9164920
MD5 hash: 2b5e4a4dfe8eda657e2f870eee3c5cb7
humanhash: yankee-ohio-crazy-tango
File name:DHL INV+AWB100617740009725.PDF____.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:317'984 bytes
First seen:2020-07-16 18:37:45 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:DHU3V4H9SnTJW+dRXIh7vsIv0WvuwD0ipppIlt4FcN39780/OlJ05zvCHdSfsI:7Wo2Uw4JkMvuyEtDNt780WlJ0p8csI
TLSH CF6423C778D24EAE2320501E8E17272AB2C1D2FA48B44E359D5A5C7784E387759247BF
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.309.biniomunidos.ml
Sending IP: 45.125.66.114
From: DHL Express Shipment Notification <noreply-dhl@309.biniomunidos.ml>
Reply-To: hektordukas1960@gmail.com
Subject: DHL INV+AWB100617740/0096254441 : Tracking No:XXXXXXXX9725
Attachment: DHL INV+AWB100617740009725.PDF____.gz (contains "DHL INV+AWB100617740009725.PDF____.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.368.13735.32695.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ecfb7c43339ee2a1fb0c6e4b124803a56c5982ccbf8073e3b17e1c3452105b6/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 18:39:05 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r3h3prbthhxcuh5qy3slcjeahjlmlgbmzp4aopr3c7q4grjbaw3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 8ecfb7c43339ee2a1fb0c6e4b124803a56c5982ccbf8073e3b17e1c3452105b6

(this sample)

AgentTesla

Executable exe 1868421d82c1476c4106fee2902fde4c749d7e8bcd9b34fdc09d86733d9198de

  
Dropping
MD5 279189f9746b79c1112ebf9cbb2daef8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1868421d82c1476c4106fee2902fde4c749d7e8bcd9b34fdc09d86733d9198de

Comments