MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2a2cfe440b18edcf0e931394ea070d7be3add32b211a01e66d7940f2d9116d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2a2cfe440b18edcf0e931394ea070d7be3add32b211a01e66d7940f2d9116d9
SHA3-384 hash: bf6f04aa0a4f0ec86030663e87bc71c2859e45e4c1a780c9739b56b2c4a96b8cc18af59e6fae9d6424cf5b9ae2fb0514
SHA1 hash: 1d28c399b925c81ad634f960914a6f13a41337e2
MD5 hash: 57f20a7ce22f6d3a765e76d37b241d41
humanhash: uranus-hamper-lamp-happy
File name:Commercial Invoice_PDF.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:698'007 bytes
First seen:2020-08-28 05:48:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:atzRko7X6actAnuWhoQJsa0Ks0XNJJkIpsZOrb7QxQnpJzU/29EFb8A0uBK/mdhJ:at+oX7cCnHnXDBNQIJyQnpJzU/p0u4/q
TLSH A7E423D2CBDC61BF34DE9C3A6A06CA71D623553947F388C30676078586D2CE5242AFDA
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dennisang.com
Sending IP: 128.199.204.148
From: DHL EXPRESS© <autoreply@dhl-supply.com>
Reply-To: DHL EXPRESS© <nicolasdiegonicolas@gmail.com>, DHL EXPRESS© <nicolasdiegonicolas@gmail.com>, DHL EXPRESS© <nicolasdiegonicolas@gmail.com>
Subject: DHL Commercial Invoice
Attachment: Commercial Invoice_PDF.zip (contains "SCANCOPY007_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Zmutzy.802.21831.11567.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2a2cfe440b18edcf0e931394ea070d7be3add32b211a01e66d7940f2d9116d9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 05:50:07 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykrm7zcawghnz4hjge4u5idq267dvxjswii2ahtg26ka6lmrc3mq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/c2a2cfe440b18edcf0e931394ea070d7be3add32b211a01e66d7940f2d9116d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c2a2cfe440b18edcf0e931394ea070d7be3add32b211a01e66d7940f2d9116d9

(this sample)

AgentTesla

Executable exe a2938e6462b02115d0579cb8a4294626eb792a781b68175844a5fb26ae6de0b6

  
Dropping
MD5 2d25eb521071cbab69e7880f261ab470
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a2938e6462b02115d0579cb8a4294626eb792a781b68175844a5fb26ae6de0b6

Comments