MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f9bf2d1063480558f9c615fda4a47a49b08af8404298f0914b937bef6f26c4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: 7f9bf2d1063480558f9c615fda4a47a49b08af8404298f0914b937bef6f26c4f
SHA1 hash: 8a8d5dcfb32b8478f8a1095bdad0ae0bb64177e6
MD5 hash: 85668d3a7ff81363fbf096c4a458cde0
File name:UPS Invoice-661754.exe
Download: download sample
Signature AgentTesla
File size:422'912 bytes
First seen:2020-05-22 13:39:07 UTC
Last seen:2020-05-22 15:01:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:PW4NR0Vbh/QIaZ0llX+YjPyvXU9yI+1bTmKPkRHYYfqZPdrowrDDWL+kw:ohiallX+Y2vE9yI2nPGHFCZPywrDKL+
TLSH 9694F11D66E82B1FC56F87F9D0E0641007F4B27A1913F75D9EE2B0DA24B7B208B61A17
Reporter @abuse_ch
Tags:AgentTesla exe UPS


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: plesk106.domitienda.com
Sending IP: 84.246.209.27
From: Invoice-notificatoin@ups.com
Subject: UPS Invoice Notification
Attachment: UPS (contains "UPS Invoice-661754.exe")

AgentTesla SMTP exfil server:
mail.cosmosgroup.in:26

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country US US
ClamAV SecuriteInfo.com.Variant.MSILPerseus.224337.25404.12385.UNOFFICIAL
VirusTotal:Virustotal results 32.88%
ReversingLabs :No data

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 7f9bf2d1063480558f9c615fda4a47a49b08af8404298f0914b937bef6f26c4f

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments