MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 574886eff075f13c40ae565183247bd12522a62277618ebc15130e8daede513d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 574886eff075f13c40ae565183247bd12522a62277618ebc15130e8daede513d
SHA3-384 hash: 583085fea9b0c5bb17335db22da64704a3523655aac90ab7639ef8b64b59d05213a0796edfb866bc3313699b9d6ebbc8
SHA1 hash: b7d910b7d05b0216e72295b9872447174a46e8bb
MD5 hash: b387a1ba53118e3c4f89d3b31fba89f8
humanhash: emma-two-oregon-network
File name:TNT consignment number 213596003_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:496'908 bytes
First seen:2020-07-21 05:42:26 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:Mj/64nVOFVJAzsuY+nHxpKqs4NZp6pvLHjz3qfxEny3NSn:KJ2osuFHxUKNZp6pjjz38xGy3NSn
TLSH C4B4233C41FD3B77F56DFCD83DB2BA49E59666541D448F788FE261312F9A8622218038
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: TNT Express <worldwide@tnt.com>
Received: from vmh18397.hosting24.com.au (vmh18397.hosting24.com.au [103.237.108.115])
Date: Tue, 21 Jul 2020 15:06:43 +1000
Subject: TNT Express Consignment Notification for 213596003.
Attachment: TNT consignment number 213596003_pdf.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Smdd-6956905-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/574886eff075f13c40ae565183247bd12522a62277618ebc15130e8daede513d/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 05:44:05 UTC
File Type:
Binary (Archive)
Extracted files:
66
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k5ein37qoxytyqfokziygjd32essfjrco5qy5pavcmhi3lw6ke6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/574886eff075f13c40ae565183247bd12522a62277618ebc15130e8daede513d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 574886eff075f13c40ae565183247bd12522a62277618ebc15130e8daede513d

(this sample)

AgentTesla

Executable exe 74b92fc96452dd15b76cef9ab688fae3f44d580953a0a4533430a526543ccddf

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74b92fc96452dd15b76cef9ab688fae3f44d580953a0a4533430a526543ccddf

Comments