MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aec344b9cb79d7d8c3ec85494ed48c8820918ab43b68dd0c019432f21b29c206. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aec344b9cb79d7d8c3ec85494ed48c8820918ab43b68dd0c019432f21b29c206
SHA3-384 hash: bf9d230f826bb0361fbdf5f0f8c2ba5a4a455f6ce22f837d6c7afc4a49b9639f7c5d9ae7872b0cf2ad27fa10c2bdd782
SHA1 hash: 3143b04b98db3832d9efac9b48cf864fb3b7f270
MD5 hash: b9dd000a3b64a7ffa171be4828c00844
humanhash: crazy-louisiana-august-oklahoma
File name:FedEx SLEDOV N -pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'023'589 bytes
First seen:2020-05-26 08:15:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:VmVJb69jIf0rjXM6LrxCQk0o/8EOZEiaJCA6H1upXDXtQTu9xiyHMUuMRKpzoRMn:zIGPNCQY/8JZgz6wpXpQOUupg
TLSH F82533F9E3E6EB6A11357200FD125C76D4FE662AA8E71B0F62E8C27500E034D9776097
Reporter abuse_ch
Tags:7z AgentTesla FedEx


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zion2.ibs.gr
Sending IP: 95.129.40.109
From: Kimberley Lin <kimberley.lin@fedex.com>
Reply-To: Kimberley Lin <dustiutd12@hotmail.com>
Subject: OZNÁMENÍ O DODÁNÍ FedEx
Attachment: FedEx SLEDOV N -pdf.7z (contains "FedEx SLEDOV N -pdf.exe")

AgentTesla FTP exfil server:
ftp.kassohome.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:47:55 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip aec344b9cb79d7d8c3ec85494ed48c8820918ab43b68dd0c019432f21b29c206

(this sample)

AgentTesla

Executable exe dd037e650592e65355d1be4a68ba8f7fe4fc8d146100a84e8195342f3a16b4f3

  
Dropping
MD5 a70a011f15978acc92d9f2434cdfe94e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd037e650592e65355d1be4a68ba8f7fe4fc8d146100a84e8195342f3a16b4f3

Comments