MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28e646b6ea5897fd1bf33a7c16a9e1478a1a58bd2fd65549aeaaa242e0b2448c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28e646b6ea5897fd1bf33a7c16a9e1478a1a58bd2fd65549aeaaa242e0b2448c
SHA3-384 hash: 972331c0361f23c48618dd8b3854a3c55ae4d8264e5a793cac6ce5c372f05ecff53ca85398502c1e5096b4d062ad07b0
SHA1 hash: 2e09c3c8bb452139a01f35be8db7faf4502c3615
MD5 hash: 0fc10eceb9a6fde47c29f1666eb4313a
humanhash: undress-quiet-mockingbird-low
File name:Consignment Invoice PLBL Draft.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:278'147 bytes
First seen:2020-05-26 10:38:02 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 3072:3eDLr+kEqiLrmWmI7bSn+YGGY51ip4yf+/GzhtdexAzfKIDoFW0ZHQRwfFnLUVtK:uDhqLr7unMrkf+YhtdeyBDoF3RQGfEeb
TLSH FC4423856C2197DB084778C4C5FBB8549AD4AE5B95DFB9DBD81B0E8032D1CE782C09C7
Reporter abuse_ch
Tags:AgentTesla r00 TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: uh1.hnc.cl
Sending IP: 190.4.193.165
From: TNT EXPRESS <service@tnt.com>
Subject: CONSIGNMENT NOTIFICATION: You Have A Package With Us
Attachment: Consignment Invoice PLBL Draft.r00 (contains "Consignment Invoice PL&BL Draft.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 12:51:19 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
13 of 30 (43.33%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 28e646b6ea5897fd1bf33a7c16a9e1478a1a58bd2fd65549aeaaa242e0b2448c

(this sample)

AgentTesla

Executable exe bdf4720f31f67d0c2457c6cc0eeeb4734778f18a1abfbbd6779977dd16f3ab46

  
Dropping
MD5 d5978f6f6122d388bf9cda47e121087e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bdf4720f31f67d0c2457c6cc0eeeb4734778f18a1abfbbd6779977dd16f3ab46

Comments