MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a9730571569678290789c40e0b578d09be5d2d5550f101d85c14c16ba770748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a9730571569678290789c40e0b578d09be5d2d5550f101d85c14c16ba770748
SHA3-384 hash: c874bb4bd34dac7333b8d0127219c3916c63bea55585f87401517277c83d534419291a2c0e68eeecabd4c4cbfdc954eb
SHA1 hash: c769502af540ea51c3387ea365365a02e800e683
MD5 hash: 5ff4a422bda50b61b8667bb1ff337e82
humanhash: twenty-sixteen-cup-nineteen
File name:FedEx-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'068'557 bytes
First seen:2020-06-02 10:23:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Zk0LUrulmCJZn0a7gajuvcwShrwbLPZJKdzci2SpDzW:Z9LUrSJZ0asac0OP6Oipp2
TLSH 693533C7BF278FA76BF0AF6EC4AB33CECC9856B262DC5154040A49A7291409E65716C3
Reporter abuse_ch
Tags:7z AgentTesla FedEx geo GRC


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 2019.modoweb.es
Sending IP: 185.37.227.24
From: Marta Slowinska (FedEx) <marta.slowinska.osv@fedex.com>
Reply-To: Marta Slowinska (FedEx) <dustiutd12@hotmail.com>
Subject: ΕΝΗΜΕΡΩΣΗ ΠΑΡΑΔΟΣΗΣ FedEx
Attachment: FedEx-pdf.7z (contains "FedEx-pdf.exe")

AgentTesla FTP exfil server:
ftp.kassohome.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 10:37:11 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rkltavyvnftyfedytraobnly2cn6luwvkuhrahmfyfgbnotxa5ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8a9730571569678290789c40e0b578d09be5d2d5550f101d85c14c16ba770748

(this sample)

AgentTesla

Executable exe 6fb3eca3bc35ceba9ce806f93a2855cec717897923851643f40e62dcecc2f14f

  
Dropping
MD5 cd5f67b3a7d561a47a7896e9b8bc3a6a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fb3eca3bc35ceba9ce806f93a2855cec717897923851643f40e62dcecc2f14f

Comments