MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5cc2da9649ceac73f18ef6fe03add950641f8ccf871d325144628595f83f4da1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 5
| SHA256 hash: | 5cc2da9649ceac73f18ef6fe03add950641f8ccf871d325144628595f83f4da1 |
|---|---|
| SHA3-384 hash: | 8641685371ddabc678a2c3473c566115f17416c34c26db2e41afe53eee1e9eb2c159539cc960900e70e07713c7acfcdd |
| SHA1 hash: | 2faf6d1a9d7ce62e81c42380f7d67aec71afea98 |
| MD5 hash: | 82750a51696e3e2a222a5d6c2233de98 |
| humanhash: | mike-friend-september-butter |
| File name: | Delivery and parking list.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'369'088 bytes |
| First seen: | 2020-05-13 06:16:05 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f63caebe1e46d29542ea606034a7da47 (7 x AgentTesla, 4 x Loki, 3 x HawkEye) |
| ssdeep | 24576:lzfHZjEuYv0l1zrSQ4oRqVc0wRdZtUV3q3CdqcyedO/:lztlR/GVc0wRtUV6Sdqc7dO/ |
| Threatray | 2'245 similar samples on MalwareBazaar |
| TLSH | 9E55D022F2E04F37C1B31A389D1B5664993ABE103B3C6A476BE91C4C5E3B7523935297 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
abuse_ch
Malspam distributing AgentTesla:HELO: hosting12.ji-net.com
Sending IP: 203.130.149.250
From: pampa <rosaroca70@gmail.com>
Subject: Delivery note/ Parking list March 2020
Attachment: Delivery and parking list.rar (contains "Delivery and parking list.exe")
AgentTesla FTP exfil server:
desguacespalomino.com:21
Intelligence
File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Fareit
Status:
Malicious
First seen:
2020-05-13 03:05:16 UTC
File Type:
PE (Exe)
Extracted files:
293
AV detection:
26 of 31 (83.87%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Similar samples:
+ 2'235 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
family:masslogger spyware stealer upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
UPX packed file
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.