MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2746ba1ff3e8258dc240c188186487c7dcb3e7ebb1dafa50c8410852fba3628. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2746ba1ff3e8258dc240c188186487c7dcb3e7ebb1dafa50c8410852fba3628
SHA3-384 hash: 853761398a3e9a4fc80af5eaa327cdaeeddc0f54ec5839068e25b84de8a6b644f6d4793ddd0620a80af8f344386c676f
SHA1 hash: 01eb4812e3d60953dce52a5d8e93f2cfc702013e
MD5 hash: d8772f071129c44370f899a939dca096
humanhash: five-three-harry-music
File name:FEDEX DELIVERY DETAILS.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:483'328 bytes
First seen:2020-06-15 13:43:08 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:h8WTonRpo+/ABHSZ0nBtsVrCTr5QYVTJpV:+WToJ/ABHSZ0nDsVgWYnX
TLSH CFA412093B681726C93E95BC5AF3118403FB99B11672E74FB9CC34681B673D66A13F22
Reporter abuse_ch
Tags:AgentTesla FedEx iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: santomera2.vhost.interdominios.com
Sending IP: 89.248.96.127
From: jeremy meredith <jaremy_meredith@ftn.fedex.com>
Subject: FedEx Shipment Notification.
Attachment: FEDEX DELIVERY DETAILS.iso (contains "YiKceODNm2HnJ3A.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34016426.19424.29719.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 13:45:04 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4j2gxip7h2bfrxbebqmidbsipr64wpt6xmo27jimqqiikl52gyua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso e2746ba1ff3e8258dc240c188186487c7dcb3e7ebb1dafa50c8410852fba3628

(this sample)

AgentTesla

Executable exe c11379bd7e59df5f1715c22cb396ac9b5c5233867936e29aa7f27b9e3b410f7e

  
Dropping
MD5 5d0b4e91effa317de3d552bbeb307023
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c11379bd7e59df5f1715c22cb396ac9b5c5233867936e29aa7f27b9e3b410f7e

Comments