MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b832b852d63644369b3df89fc766d79c925243cc151acbfa76f45c3576be39a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b832b852d63644369b3df89fc766d79c925243cc151acbfa76f45c3576be39a
SHA3-384 hash: 7955aa9aa26be938ef7c9a69f7b0e0130cb9c17d5f10c4dba8b8552ed58546355f6f4eac6afc28bf1386ce7bcbd6084c
SHA1 hash: 74b120b3e7e331be67508f08b2593d102b55a77e
MD5 hash: 0a2b50ac4d6990a8b479714e78812757
humanhash: avocado-batman-lemon-asparagus
File name:TNT INV_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:489'732 bytes
First seen:2020-05-27 11:03:19 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:MpOhlYpX+a3pk+fyNhokzaHQHkGZ5+U5Hner6Js4rLvK4qxb:MpCkN3Jy3ftEG15HerT4rbRqxb
TLSH CCA4238F947A1CC965E5F846CF00DCC06CE6D275138BAADC147ACAE3344A075E4AFA9D
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: TNT Express <worldwide@tnt.com>
Received: from mail.vinylbannersprinting.co.uk (mail.vinylbannersprinting.co.uk [217.174.249.10])
Date: Wed, 27 May 2020 10:46:14 +0100
Subject: TNT Express eInvoice Notification: 09004105 - Account: 00022259
Attachment: TNT INV_pdf.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 10:50:28 UTC
File Type:
Binary (Archive)
Extracted files:
276
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4b832b852d63644369b3df89fc766d79c925243cc151acbfa76f45c3576be39a

(this sample)

AgentTesla

Executable exe c335cb713f229788dc06a853825d15863c58d86b3057790c19e00714c39d2d0e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c335cb713f229788dc06a853825d15863c58d86b3057790c19e00714c39d2d0e
  
Dropping
AgentTesla

Comments