MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9a5f2149058a1a9ab89cd0140fd9b6f91fe4d8039498e98dddbcf367de29fdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9a5f2149058a1a9ab89cd0140fd9b6f91fe4d8039498e98dddbcf367de29fdc
SHA3-384 hash: 2a12b7c074fd0ae593251c334667ee1a024c0fa20498a5892f1b2141c40bdf96f6fb23eb56223b7f5a62147c9e2436d9
SHA1 hash: dc926929924be9c1e8809d7cfc29d8f7dc1264b5
MD5 hash: 0f848ab8906b0ac8d2831448ef9749e8
humanhash: colorado-oregon-shade-cat
File name:Shipping Documents Waybill no 69793741500.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'392 bytes
First seen:2020-06-24 05:50:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:usa5QA36omCAnOMWykPl7S0x4x51Ldq80ZhVlR:uzB36uBS0Apq80ZhZ
TLSH D09423D0773011439ACAF446BCCCB0FAF258AE924DD565D0CE2A0D83BF817863A37666
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 95.211.208.25
From: DHL | Global | Forwarding <dispatch.dept@dhl.com>
Subject: RE: DHL单号 Shipment Delivery Air Waybill no 69793741500 24/06/2020
Attachment: Shipping Documents Waybill no 69793741500.pdf.zip (contains "Shipping Documents Waybill no 69793741500.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9a5f2149058a1a9ab89cd0140fd9b6f91fe4d8039498e98dddbcf367de29fdc/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 05:51:04 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vgs7efeqlcq2tk4jzuaub7m3n6i74tmahfey5gg53phtm7pct7oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a9a5f2149058a1a9ab89cd0140fd9b6f91fe4d8039498e98dddbcf367de29fdc

(this sample)

AgentTesla

Executable exe df517a9dbaa0829415080a30f0d2f4d0eb27082aa9f8706997c4f7b3008ebdd0

  
Dropping
MD5 4778aae302047edb758db94a7c44ba33
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 df517a9dbaa0829415080a30f0d2f4d0eb27082aa9f8706997c4f7b3008ebdd0

Comments