MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9834cd13e446c0aeb78d3b39aab61bbd43d11876454b3d9ce48ef7c69dedaa7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9834cd13e446c0aeb78d3b39aab61bbd43d11876454b3d9ce48ef7c69dedaa7
SHA3-384 hash: 62498a66a408be0cfef6178f2910fe8fb1896f70873a7eb6873580f549e9e221e257f886d3fd4d1f34e5350fce86afdb
SHA1 hash: cc6f654e3a591d287bb12c447c3e80cd024cf4d3
MD5 hash: f743f4ad78920c275fa10334fa7376c2
humanhash: venus-blue-charlie-three
File name:Document-Invoice.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:557'192 bytes
First seen:2020-08-12 15:46:32 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:6l75VdOIaJam+sf+tQmdYc0FTKhGlkSAbmdT13D+JSTL4+23VQRNitdCGyuKBBll:I77kLPctsVKhU+JCL4kNirB5znowVaZz
TLSH 9BC42353DB45F7BB68833FC9A88CF15684D808283C9174ADEA6738149E7B163F3E4664
Reporter abuse_ch
Tags:AgentTesla FedEx gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.sap-express.com
Sending IP: 103.31.132.106
From: FedEx Express <monu.kumar@fedex.com>
Subject: FedEx Express Parcel Delivery//Notification
Attachment: Document-Invoice.gz (contains "Document-Invoice.exe")

AgentTesla SMTP exfil server:
smtp.outlook.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.RSharedStrings.14309.22454.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9834cd13e446c0aeb78d3b39aab61bbd43d11876454b3d9ce48ef7c69dedaa7/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 15:48:07 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5gbuzuj6irwav23y2ozzvk3bxpkd2emhmrklhwoojdxxy2o63ktq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e9834cd13e446c0aeb78d3b39aab61bbd43d11876454b3d9ce48ef7c69dedaa7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz e9834cd13e446c0aeb78d3b39aab61bbd43d11876454b3d9ce48ef7c69dedaa7

(this sample)

AgentTesla

Executable exe b3cbf1f12ae225e86e853b5a9c100248eac70557eaffff26020cdc9d165f3ff9

  
Dropping
MD5 e5e98bf38c78fc3b886beb4f2331bd33
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3cbf1f12ae225e86e853b5a9c100248eac70557eaffff26020cdc9d165f3ff9

Comments