MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96e02edd2b0191cb1cc52426a345fc6ea05b7dc9b9aa4f8e4939b03df1eefcf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96e02edd2b0191cb1cc52426a345fc6ea05b7dc9b9aa4f8e4939b03df1eefcf8
SHA3-384 hash: be64fd83a1583f228b0d89df89a9443e2308099f0f2d2204d59065778b03873be3190e8bc0a7c1bd32d6e7909c276f2d
SHA1 hash: 921b87686900eaf876e34618bc5349be5469d87c
MD5 hash: cce728530a31093d8b4f461544e80f4d
humanhash: william-pip-nitrogen-undress
File name:ETA 3007毛重18.60公斤网）从GUMTEC-KOREA交付.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:652'757 bytes
First seen:2020-07-30 07:11:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Ny79es/s5sSGgIIE0qLuD4dxI9FxLTb+2yylItXjeGrjNrYGV6oa0T2z:NwBEOS9I1LuDe0Fhki+aGVYZQ2z
TLSH CFD42308ACE67FC5757A9C4E318CDA3EE35281816A8D09DF585D8CDE72143429F92CBE
Reporter abuse_ch
Tags:AgentTesla cab DHL geo KOR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 95.211.208.25
From: Huang Yuanliang (DHL TW)<Janice.Fernandes@dhl.com>
Subject: [DHL] AWB收货（ETA 30/07毛重18.60公斤/网）从GUMTEC-KOREA交付
Attachment: ETA 3007毛重18.60公斤网）从GUMTEC-KOREA交付.cab (contains "ETA 3007毛重18.60公斤网）从GUMTEC-KOREA交付.exe")

AgentTesla SMTP exfil server:
smtp.dachanq.cc:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96e02edd2b0191cb1cc52426a345fc6ea05b7dc9b9aa4f8e4939b03df1eefcf8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 07:13:04 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s3qc5xjlagi4whgfeqtkgrp4n2qfw7ojxgve7dsjhgyd34po7t4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/96e02edd2b0191cb1cc52426a345fc6ea05b7dc9b9aa4f8e4939b03df1eefcf8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 96e02edd2b0191cb1cc52426a345fc6ea05b7dc9b9aa4f8e4939b03df1eefcf8

(this sample)

AgentTesla

Executable exe 712c469c4b665f6e9670dbcf5c2b05353b3f26580b204876d89187d66240b8fb

  
Dropping
MD5 89f51e8b0c3e9b0a652a7ad9b7ec3aff
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 712c469c4b665f6e9670dbcf5c2b05353b3f26580b204876d89187d66240b8fb

Comments