MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6216dde74e6cd869a9b4d9b31488bbe64066d6a29c0121a735751166ce4fc5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6216dde74e6cd869a9b4d9b31488bbe64066d6a29c0121a735751166ce4fc5e
SHA3-384 hash: 3691c0b6bff54b511656cfe4ca2172ea342f0b1afce75700ad900231ce5628a656ced83f5f85c8422e960bc5ebbc16ee
SHA1 hash: dd4b8861f86d68d857095ecab6b2dbf4a505177f
MD5 hash: 46654329630895b56eeb9f91019fabf5
humanhash: pasta-nine-mars-floor
File name:Shipping Doc_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:439'784 bytes
First seen:2020-05-08 09:11:16 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:QcaoKBiJhcF1x4i6SRXGwcAcfZ5DEB96Cs1o:QlpBiJo4i622wcAcfrEBAM
TLSH 1194230547E3DAD272DA1FFE6DE8D23C8D122641B9A7106BFA2517D2493123872BC9D2
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.vinylbannersprinting.co.uk
Sending IP: 217.174.249.10
From: DHL EXPRESS <worldwide@dhl.com>
Subject: DHL Express shipment per-alert!!
Attachment: Shipping Doc_pdf.gz (contains "Shipping Doc_pdf.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 09:36:08 UTC
File Type:
Binary (Archive)
Extracted files:
66
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4yqw3xtu43gyngu3jwntcselxzsam3lkfhabegttk5irm3he7rpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz e6216dde74e6cd869a9b4d9b31488bbe64066d6a29c0121a735751166ce4fc5e

(this sample)

AgentTesla

Executable exe 0deda45a2661e3f8536e3b90103004d183fc5403fd6e33895ba15bab4a6dca3f

  
Dropping
MD5 daed7a0f642001c81be81d87c94b3261
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0deda45a2661e3f8536e3b90103004d183fc5403fd6e33895ba15bab4a6dca3f

Comments