MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fe24739c13bb21a3575e277bf602be00a59abb2a468b6264880ab7919232690. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fe24739c13bb21a3575e277bf602be00a59abb2a468b6264880ab7919232690
SHA3-384 hash: 11b227a4aa96ee1958cc53d58d11079f2c15a97c3d52851fca2eec9d952612357653bc13d4d9e9b5615d436eb8ce8baf
SHA1 hash: 082c2bace1fd606e302140f8aa143da99688bb35
MD5 hash: 8bfcbf848bd6b9a2415440f8505a6e51
humanhash: speaker-september-black-music
File name:Invoice from PALLET LOGISTICS LIMITED.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:533'228 bytes
First seen:2020-05-05 07:11:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:DsjkgP6uilNY0KDiIHNh6un6FvU7g6Exizk52s+W3VcsgS:DsjkgP6FjKXfnn6FU/Exi45tV3VcsgS
TLSH 72B42333EE0C37B5E5AC4532FDF2F769370E1985668789882BF6E430312A9617125CAD
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: freightreach.com
Sending IP: 103.145.253.9
From: Denny Varghese <support@freightreach.com>
Subject: RE: Invoice from PALLET LOGISTICS LIMITED
Attachment: Invoice from PALLET LOGISTICS LIMITED.gz (contains "Invoice from PALLET LOGISTICS LIMITED.exe")

AgentTesla SMTP exfil server:
mail.scandinavian-collection.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.39548.185.2688.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24016.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 02:55:00 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7reooobhozbunlv4j336ybl4afftk5surulmjsiqcvxsgjde2ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1fe24739c13bb21a3575e277bf602be00a59abb2a468b6264880ab7919232690

(this sample)

AgentTesla

Executable exe 47ec39cfdf321c1631729979555d963b9cb54cacf54bd5773d5113552afb5899

  
Dropping
MD5 eae8e5a45d1688ca31bb5e43c3364163
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 47ec39cfdf321c1631729979555d963b9cb54cacf54bd5773d5113552afb5899

Comments