MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e44809af61f0279d1c58dbc7408b3ddf69345c126983b62ba94f40e616a22c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e44809af61f0279d1c58dbc7408b3ddf69345c126983b62ba94f40e616a22c3
SHA3-384 hash: 16c9e5533f96c0e31945ea267a1c1ff0df1b301c3e243974dae54a6f0318bfebd0370de9a3275022da42eca98a079948
SHA1 hash: d7d6e9bde139e30dba248d65432854547e5af3d0
MD5 hash: a5a3a4a7684c163383a5f2f6f9cc20ce
humanhash: seven-earth-apart-emma
File name:Shipping Invoice PLBL Draft.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:792'576 bytes
First seen:2020-06-08 12:23:49 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:RaUPS66VEJD6LpZqIBhKfZ2aGCA1D6tbcYJRb6e8kGbn7eEdR8:RaU96VEt6+0KfTGCA1DUgLQ
TLSH 86F417EB76406405D13D0D7244957E9C66B2AAC73A01CF0FF9EA2F5CAF223CA6F05259
Reporter abuse_ch
Tags:AgentTesla iso TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.bridgemetal.xyz
Sending IP: 161.35.228.46
From: TNT EXPRESS <service@tnt.com>
Subject: Consignment Notification: You have A Package With Us
Attachment: Shipping Invoice PLBL Draft.iso (contains "Shipping Invoice PL&BL Draft.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:25:09 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bzcibgxwd4bhtuofrw6hicft3x3jgrobe2mdwyv2st2a4ylkelbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 0e44809af61f0279d1c58dbc7408b3ddf69345c126983b62ba94f40e616a22c3

(this sample)

AgentTesla

Executable exe c77c5b4a3662589a0b9bb1b9bdde49afe9ab55d2b1ac17a1c23e056801c1a922

  
Dropping
MD5 8365569e7146e85b550818500f5bfb2e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c77c5b4a3662589a0b9bb1b9bdde49afe9ab55d2b1ac17a1c23e056801c1a922

Comments