MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a76c7cc7eab043d29419721411f37617e5d1248b6eb582f83df941973f28ae5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a76c7cc7eab043d29419721411f37617e5d1248b6eb582f83df941973f28ae5
SHA3-384 hash: eb44cbb4416440d80d62ca36904d9d387e25ee764072b3cc1a1c81b29f3c24bba9d9c2ccebcf88cbaeea440020d70f1a
SHA1 hash: 91dc3fd6e38225e0089aaf4b15156531387c71e0
MD5 hash: c0430fcdf6a0b9672132d7e30e2f3be0
humanhash: bulldog-summer-georgia-enemy
File name:FedEx_Shipment_Form.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:264'826 bytes
First seen:2020-06-08 15:06:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:PzqoCrscMPh5S+rYVOWk9a3xCzW36bkTINlVDZqVOg1Rk1:POomI5S+c8aAszUXVDgR1Rk1
TLSH F6442319BE1B258BF6370DEF9CEAC20509552988B0685771539C9A83D3367B3821F2FD
Reporter abuse_ch
Tags:AgentTesla FedEx zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alias0s216554.cloud.flynet.pro
Sending IP: 91.221.37.67
From: FedEx <FedEx@industralnews.com>
Reply-To: mmurhaf23@gmail.com
Subject: FedEx Shipment 815378531188 Not Delivered.
Attachment: FedEx_Shipment_Form.zip (contains "FedEx_Shipment_Form.exe")

AgentTesla SMTP exfil server:
mail.marketinfosales.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 15:08:05 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rj3mptd6vmcd2kkbs4quchzxmf7f2esiw3vvql4d36kbs47srlsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8a76c7cc7eab043d29419721411f37617e5d1248b6eb582f83df941973f28ae5

(this sample)

AgentTesla

Executable exe 6e3a137a621b11e16fb46aa747fae37564a0cd03e57873193fa5f772a5822628

  
Dropping
MD5 64eadca89163fb85798474ad7e977ae7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6e3a137a621b11e16fb46aa747fae37564a0cd03e57873193fa5f772a5822628

Comments