MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49cef8353d655f5f8bcbb93152a60779eb4b68ee07146fe83742789040a63004. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49cef8353d655f5f8bcbb93152a60779eb4b68ee07146fe83742789040a63004
SHA3-384 hash: 40f497c19c521fc1aae80db7c4d1d1f872a9f2f1d0a5a58137e30ad48ce6161c702cddc8c4d245c287c4316d3473c2f0
SHA1 hash: c9c3a56692eed159d6369b4b8f526ee8370ee711
MD5 hash: 2c40007b1897a439e0768e4d01ae6596
humanhash: batman-fanta-potato-freddie
File name:FedExi jälgimisandmed-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'003'797 bytes
First seen:2020-06-18 06:09:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:zcsPZlmezZ70nCQC0Mt/eSzFN/rumZ8Y8CbLOrSUERh:z5dzZgFC5/eVC8Y8eLOrSvRh
TLSH F32533C22B8CEBF60BED5594B35D6ABADC0862F6C96C740AAE30CCD0DD5A474FB46015
Reporter abuse_ch
Tags:7z AgentTesla EST FedEx geo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.linux95.papaki.gr
Sending IP: 159.69.67.170
From: Kimberley Lin <kimberley.lin@fedex.com>
Reply-To: Kimberley Lin <dustiutd12@hotmail.com>
Subject: FedExi kohaletoimetamisteade
Attachment: FedExi jälgimisandmed-pdf.7z (contains "FedExi jälgimisandmed-pdf.exe")

AgentTesla FTP exfil server:
ftp.kassohome.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:11:04 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhhpqnj5mvpv7c6lxeyvfjqhphvuw2hoa4kg72bxij4jaqfggaca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 49cef8353d655f5f8bcbb93152a60779eb4b68ee07146fe83742789040a63004

(this sample)

AgentTesla

Executable exe d846912135d84580a51b7304ac088a59fad4708b6193e25a8dfd6e515164976c

  
Dropping
MD5 1150b9a59ef934775c16bdf0a3358540
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d846912135d84580a51b7304ac088a59fad4708b6193e25a8dfd6e515164976c

Comments