MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49cef8353d655f5f8bcbb93152a60779eb4b68ee07146fe83742789040a63004. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 49cef8353d655f5f8bcbb93152a60779eb4b68ee07146fe83742789040a63004
SHA3-384 hash: 40f497c19c521fc1aae80db7c4d1d1f872a9f2f1d0a5a58137e30ad48ce6161c702cddc8c4d245c287c4316d3473c2f0
SHA1 hash: c9c3a56692eed159d6369b4b8f526ee8370ee711
MD5 hash: 2c40007b1897a439e0768e4d01ae6596
humanhash: batman-fanta-potato-freddie
File name:FedExi jälgimisandmed-pdf.7z
Download: download sample
Signature AgentTesla
File size:1'003'797 bytes
First seen:2020-06-18 06:09:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:zcsPZlmezZ70nCQC0Mt/eSzFN/rumZ8Y8CbLOrSUERh:z5dzZgFC5/eVC8Y8eLOrSvRh
TLSH F32533C22B8CEBF60BED5594B35D6ABADC0862F6C96C740AAE30CCD0DD5A474FB46015
Reporter @abuse_ch
Tags:7z AgentTesla EST FedEx geo


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: server.linux95.papaki.gr
Sending IP: 159.69.67.170
From: Kimberley Lin <kimberley.lin@fedex.com>
Reply-To: Kimberley Lin <dustiutd12@hotmail.com>
Subject: FedExi kohaletoimetamisteade
Attachment: FedExi jälgimisandmed-pdf.7z (contains "FedExi jälgimisandmed-pdf.exe")

AgentTesla FTP exfil server:
ftp.kassohome.com.tr:21

Intelligence


File Origin
# of uploads :
1
# of downloads :
34
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Medium
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-06-18 06:11:04 UTC
AV detection:
17 of 48 (35.42%)
Threat level
  5/5

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 49cef8353d655f5f8bcbb93152a60779eb4b68ee07146fe83742789040a63004

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments