MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a42bb7429fc7b285edc50b2a8a6a539d89ae0eee7ef545103a91834c586c4487. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: a42bb7429fc7b285edc50b2a8a6a539d89ae0eee7ef545103a91834c586c4487
SHA1 hash: 2fc2760cffe17bf5574b12293eb33d1a1b2e0d8f
MD5 hash: 0591e988e5f5bb493761ccb1d1ed552f
File name:DHL EXPRESS AWB doc.rar
Download: download sample
Signature AgentTesla
File size:412'377 bytes
First seen:2020-05-22 13:55:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Mi1dJPugdYg8sPPBseZyFGgVvTVCuPLtiDb:Mi13PugdYg9PSeZyTNLtw
TLSH F994233EE73149D9D0FB9F2505C4834DBBCC8A1BD0E20068AF389B628C15EB994759D5
Reporter @abuse_ch
Tags:AgentTesla DHL rar


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: ns1.arkansasappraisal.pw
Sending IP: 138.197.128.156
From: DHL EXpress Shipment<dhl@dhlservice.com>
Subject: DHL EXPRESS AWB NOTIFICATION
Attachment: DHL EXPRESS AWB doc.rar (contains "DHL EXPRESS AWB doc.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 20
Origin country FR FR
ClamAV No detection
VirusTotal:Virustotal results 30.00%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a42bb7429fc7b285edc50b2a8a6a539d89ae0eee7ef545103a91834c586c4487

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments