MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3fdc313fbe3c620f9f7ed163f47fb8f153cdd7fb3822b90f543627050ab4df2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3fdc313fbe3c620f9f7ed163f47fb8f153cdd7fb3822b90f543627050ab4df2
SHA3-384 hash: 4c3fdcfb23bd0a21819e4dfecb642f3117814c666c6fda8fd345f7a004b61ffe47c8e7ed394f6029a5ea78edd0d906fb
SHA1 hash: 3fd3e0929bf90d4d56335e92f2b16f8c413b86a7
MD5 hash: 63fa7120b78e8168b19a55a5b01241ed
humanhash: bacon-wolfram-alabama-timing
File name:BL Original Shipping Documents AWB-62987268.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:539'863 bytes
First seen:2020-07-21 18:38:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:E0pHUW6rEbBQNYhtv9tQKPq/O7uXUR0f2WDB9bJAGd5TGAhvGDNWhf:E0BJbBQ+moDOPOWVbJq4Z
TLSH 56B4232F44F85A7869E33671CF721D492718BA2D7E4D6F478ADE934683240D2E626F08
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwhk121-11.mailset.cn
Sending IP: 107.150.121.11
From: DHL EXPRESS<dhlexpress@dhl.com>
Subject: DHL EXPRESS AWB Shipment Arrival Waybill No. :AWB-62987268
Attachment: BL Original Shipping Documents AWB-62987268.zip (contains "BL & Original Shipping Documents AWB-62987268.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EOQO.31473.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3fdc313fbe3c620f9f7ed163f47fb8f153cdd7fb3822b90f543627050ab4df2/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 18:40:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yp64ge734pdcb6px5uld6r73r4ktzxl7wobcxehvinrhaufljxza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c3fdc313fbe3c620f9f7ed163f47fb8f153cdd7fb3822b90f543627050ab4df2

(this sample)

AgentTesla

Executable exe 8ac57ec0d32b453aa23a1c7149d5cd5695c8a99a9bd0b792bfc1411b1216c4da

  
Dropping
MD5 7236e60628c25d1b48ae9de6eb5e6b8c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ac57ec0d32b453aa23a1c7149d5cd5695c8a99a9bd0b792bfc1411b1216c4da

Comments