MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b863b0212bb5243a2b0c2f562d59f1f0ae2c07c65654801dae3a3396fd95af55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b863b0212bb5243a2b0c2f562d59f1f0ae2c07c65654801dae3a3396fd95af55
SHA3-384 hash: 1f187e5707bf36f070c1db0c2373999800da72040373b1d79aed2cb4a7e34eb257d971b8769303ef81f5b9f1b1865a71
SHA1 hash: 6e5b0e30b02a317a5b5b0153ac4881f31bb243ba
MD5 hash: 45b82747ff937464d6a0ac89014f57c1
humanhash: skylark-comet-tennis-oklahoma
File name:FedEx_Aug 2020 at 1.11_8BZ290_PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'031'616 bytes
First seen:2020-08-04 11:20:07 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:3iDDSEiiCMGtisfATO+mbr+2lgo9sA9dNcunEharpsWTi0bJu8zyDgtbzLfE3:7ztvLieL+aryd0cxMb/83
TLSH 519507277A076A71C24D4778C78358654733A58033AFD50E26CE1392E93B79F586E38B
Reporter abuse_ch
Tags:AgentTesla FedEx img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pleskl2ssd.axarnet.es
Sending IP: 149.62.169.212
From: FedEx Support Delivery <shipment@fedex.com>
Subject: RE: Shipment delivery problem #00000964421
Attachment: FedEx_Aug 2020 at 1.11_8BZ290_PDF.img (contains "FedEx_Aug 2020 at 1.11_8BZ290_PDF.exe")

AgentTesla SMTP exfil server:
mail.beljemi.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.7729.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b863b0212bb5243a2b0c2f562d59f1f0ae2c07c65654801dae3a3396fd95af55/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:22:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xbr3aijlwusdukymf5lc2wpr6cxcyb6gkzkiahnohizzn7mvv5kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b863b0212bb5243a2b0c2f562d59f1f0ae2c07c65654801dae3a3396fd95af55

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img b863b0212bb5243a2b0c2f562d59f1f0ae2c07c65654801dae3a3396fd95af55

(this sample)

AgentTesla

Executable exe 0290b4bba5483f6c9865c8b2a1df7e0756a6d5ade4a2dc5ced0a380a9988d35c

  
Dropping
MD5 a3a7a2e78f4d7037239580da96a0152d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0290b4bba5483f6c9865c8b2a1df7e0756a6d5ade4a2dc5ced0a380a9988d35c

Comments