MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b914eea875573f33a99a55e63b0c9629c9aa49e00ef46c62e84f6d2f34ceb11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b914eea875573f33a99a55e63b0c9629c9aa49e00ef46c62e84f6d2f34ceb11
SHA3-384 hash: 1697a2e5ea0a70936f073c13d66c2d2d78613991660e9cfdbe415b01f2003a968bcc7411648d30307fe5cdca117c1753
SHA1 hash: 546a3c5a2ae178829537e4b75d7d2e4cda376c1a
MD5 hash: 4bedec98efbe530aeadc1138fa759484
humanhash: four-cardinal-georgia-snake
File name:Shipping DOC -Arrival Notice For BL - 120910126192 Vessel - MV Crystal BAY Voyage - 19014S.pdf.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:462'088 bytes
First seen:2020-07-28 05:21:48 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:AUJFldE6rN/vtxq/vkP7nxqAw1PH4qWMqpdioKY:xHdE6lHUu7nxtu4D3WY
TLSH E4A423EC29A752C0388CE027514CDDE5744363DE31B7656ACB8134CED99DCFEA62A84B
Reporter cocaman
Tags:AgentTesla arj


Avatar
cocaman
Malicious email
From: Logistics <rfreire@faracelogistica.com.ar>
Received: from faracelogistica.com.ar (unknown [209.58.149.99])
Date: 27 Jul 2020 23:56:43 -0700
Subject: RE: Arrival Notice For BL - 128910042192 / Vessel - MV Crystal BAY / Voyage - 19014S
Attachment: Shipping DOC -Arrival Notice For BL - 120910126192 Vessel - MV Crystal BAY Voyage - 19014S.pdf.arj

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b914eea875573f33a99a55e63b0c9629c9aa49e00ef46c62e84f6d2f34ceb11/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 05:23:05 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=foiu52uhkvz7gouzuvpghmgjmkojvje6adxunrroqt3nf42m5miq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b914eea875573f33a99a55e63b0c9629c9aa49e00ef46c62e84f6d2f34ceb11

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 2b914eea875573f33a99a55e63b0c9629c9aa49e00ef46c62e84f6d2f34ceb11

(this sample)

AgentTesla

Executable exe 9c5a33f434a06a68d045df0070f21738d9b2f70aa3900096eef9b1faa42a5271

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c5a33f434a06a68d045df0070f21738d9b2f70aa3900096eef9b1faa42a5271
  
Dropping
AgentTesla

Comments