MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23d33c2cb7c5d05a838c43e3e74105a975e4b3856550669f1d16836d0295fa14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23d33c2cb7c5d05a838c43e3e74105a975e4b3856550669f1d16836d0295fa14
SHA3-384 hash: 8a727f09cd21702ab02d304c7624edf8fc199f53cd4af71b1c639ce4d7ad1eefd613fe7a0b3fdd684b4a70865d8c0c37
SHA1 hash: 667ead23c8e7f670cc1ef576fd106186460fc7e2
MD5 hash: 90f40f57878a4217836d9dfd81e48674
humanhash: blue-orange-johnny-nineteen
File name:Shipping Document PLBL Draft.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'074 bytes
First seen:2020-07-13 11:25:33 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:Uu4WZrK2Q28jCp1iSeFA0UKssjnrhPtpizilc8YSHoeBpVOsuZ:UujtKof0FFvtjnrnlc8rHzAZ
TLSH 305423463EAD49FE4B821DA5C152839DF8961209742991E2D33CBF30CA86E451FB7EC3
Reporter abuse_ch
Tags:AgentTesla r00 TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sip2-191.nexcess.net
Sending IP: 104.207.255.152
From: TNT EXPRESS <service@tnt.com>
Subject: Consignment Notification: You have A Package With Us
Attachment: Shipping Document PLBL Draft.r00 (contains "Shipping Document PL&BL Draft.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23d33c2cb7c5d05a838c43e3e74105a975e4b3856550669f1d16836d0295fa14/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:27:05 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=epjtylfxyxifva4mipr6oqifvf26jm4fmvignhy5c2bw2auv7ika._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 23d33c2cb7c5d05a838c43e3e74105a975e4b3856550669f1d16836d0295fa14

(this sample)

AgentTesla

Executable exe 5d6d79cf8e947dbd356240026f305d09c23e61990bf0302d9020d7fa935254ae

  
Dropping
MD5 bfefe46f1d547f9da51fc00409829a09
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d6d79cf8e947dbd356240026f305d09c23e61990bf0302d9020d7fa935254ae

Comments