MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0499bdaa5a2407579f7c1a6d60dd3b8fc393f338ed352acf92d0554b4a4e37d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0499bdaa5a2407579f7c1a6d60dd3b8fc393f338ed352acf92d0554b4a4e37d
SHA3-384 hash: 93db0caf08c6d68c0a750a54a999b1918de224e02e06aa57837792b8bb906a3c7c5a3d28aa96e9c522b6622809fd8f54
SHA1 hash: 0e5e37b0a4d6e80b659880b793271ebbc6324bae
MD5 hash: b789de7911e1ac6705a9c64dcc5d16f9
humanhash: nevada-happy-jig-asparagus
File name:New shipment document for you.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-04 07:24:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:vIL+gJ6E881BUxh4GC5LXgrKu4xBXLdNhloyjt0RV/Mth2nmkVn:vsBUxqtX5uIHloa5Kn
TLSH F645CED136600795C5ABA3B59F3794E83FB6A4F9E1F1D6081D8EE0D90623B470603AB7
Reporter abuse_ch
Tags:AgentTesla FedEx img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.postaexpress.net
Sending IP: 46.101.185.140
From: "FedEx Express" <me@postaexpress.net>
Subject: Your package just arrived - schedule your delivery time
Attachment: New shipment document for you.img (contains "New shipment document for you.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FVX4D1A801103D8.21215.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a0499bdaa5a2407579f7c1a6d60dd3b8fc393f338ed352acf92d0554b4a4e37d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 19:32:09 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ubezxwvfujahk6pxygtnmdotxd6dspztr3jvflhzfucvjnfe4n6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img a0499bdaa5a2407579f7c1a6d60dd3b8fc393f338ed352acf92d0554b4a4e37d

(this sample)

AgentTesla

Executable exe a6cb21742488b2257cc39988ced61f7ef5be6d3eff506c10fbc265aa560e6bd4

  
Dropping
MD5 4d1a801103d87a6bb9d3e26689ef8983
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6cb21742488b2257cc39988ced61f7ef5be6d3eff506c10fbc265aa560e6bd4

Comments