MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 582b013dfb2de7f7253ec123cc6a57b0466b15881b2d5d29bc64edf0df27ac6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 582b013dfb2de7f7253ec123cc6a57b0466b15881b2d5d29bc64edf0df27ac6d
SHA3-384 hash: 7600d1da9cf5ec3810ff456c30dbfa5f1000458c3084ba23453391ca429f049f9b3817092070c7a5bdc26c1c3b5857f7
SHA1 hash: b3771d5b7fffc11e73f98dc088ea0d07f3af0aad
MD5 hash: ca6754fa9565de6c14b5b41205730752
humanhash: michigan-red-west-yankee
File name:FedEx TRACKING DETAILS-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:285'839 bytes
First seen:2020-07-16 06:34:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:FMuH67WhKAEKsZZMH19ArE3xyWBIBmhAOO6o6FNS1:FMuaHgz73xySIB4FoeS1
TLSH 965423E1ADFF6F62BC1E80EA83546FCF9D3046502B676A557062E0CE961FA703E47118
Reporter abuse_ch
Tags:7z AgentTesla FedEx


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gyp.gr
Sending IP: 46.227.62.27
From: Nubia Felicia Granados (FedEx) <nubia.granados@fedex.com>
Reply-To: Nubia Felicia Granados (FedEx) <dustiutd12@hotmail.com>
Subject: FedEx DELIVERY NOTIFICATION
Attachment: FedEx TRACKING DETAILS-pdf.7z (contains "FedEx TRACKING DETAILS-pdf.exe")

AgentTesla FTP exfil server:
ftp.samarasae.gr:21

AgentTesla FTP exfil user name:
intel101@samarasae.gr

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/582b013dfb2de7f7253ec123cc6a57b0466b15881b2d5d29bc64edf0df27ac6d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 06:36:06 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lavqcpp3fxt7ojj6yer4y2sxwbdgwfmidmwv2kn4mtw7bxzhvrwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 582b013dfb2de7f7253ec123cc6a57b0466b15881b2d5d29bc64edf0df27ac6d

(this sample)

AgentTesla

Executable exe a53aa039dd319d6f8f791f9bc8e1b3dcf253ec019900e30d9c0c15020750ee70

  
Dropping
MD5 1f2b5105ea4da0026368ad2e0cb78d0a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a53aa039dd319d6f8f791f9bc8e1b3dcf253ec019900e30d9c0c15020750ee70

Comments