MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b8befb330599702e55b91f4487fc84ff24bdfde5bad3bcce48f4a2de90d92d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b8befb330599702e55b91f4487fc84ff24bdfde5bad3bcce48f4a2de90d92d3
SHA3-384 hash: eec8ad4aa6d134b1f0b89dd9710c24e3fed4fd1f0601a3c2ffb6852b9143b97774720222b090c8bdf306519880842277
SHA1 hash: 22d80ed112a941f67c0f750304c6555878b39db4
MD5 hash: b66f4630ffc7bfe039924664d039af3d
humanhash: bacon-johnny-river-oven
File name:Shipping Documents PLBL Draft.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:348'116 bytes
First seen:2020-05-07 11:30:59 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:NqBE2exY6RXQdCSVMIKz7hSteSosk0o2Meu+Qyhn8oWdu2hN1zFrZSOO9:AevJxxSVM8eS9J7ue8oajFhLC
TLSH 397423C7D381322DE57E6DB7935125064EAA26FC30713A82E9E613787C9388AD5FD844
Reporter abuse_ch
Tags:AgentTesla r00 TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO:
Sending IP:
From: TNT EXPRESS <service@tnt.com>
Subject: Consignment Notification: You have A Package With Us
Attachment: Shipping Documents PLBL Draft.r00 (contains "Shipping Documents PL&BL Draft.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 11:35:43 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hof67mzqlglqfzk3sh2eq76ij7zexx66lowtxther5fc32insljq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 3b8befb330599702e55b91f4487fc84ff24bdfde5bad3bcce48f4a2de90d92d3

(this sample)

AgentTesla

Executable exe 65ba1403578ca11aedad856e85f17647e3d636a6556ae0a8202336505e244c24

  
Dropping
MD5 d60f84629c403a455573bc5aa9d1f002
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 65ba1403578ca11aedad856e85f17647e3d636a6556ae0a8202336505e244c24

Comments