MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 675917758737c29a19d20e5b82494339d6f78365bf23c36c4341de5c42eed973. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 675917758737c29a19d20e5b82494339d6f78365bf23c36c4341de5c42eed973
SHA3-384 hash: 975ce306c07657c3101b32d8e4f670ff0359b9e5ffed0a5fe8680bfdbdfb39487b4972be7c9b007606b4910cac85544a
SHA1 hash: 71dba6b93c9f29df3bdfff42917b1d42d6e08fd4
MD5 hash: 30daa3c3aa26aca3f8d0bef5f2777217
humanhash: purple-dakota-white-massachusetts
File name:Consignment Document PLBL Draft.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:262'665 bytes
First seen:2020-06-16 05:40:47 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 6144:J60GQS7rf3KVLvNsWGisYIx+X1pAY8/O2hoe:JeT3oVdG5+F6Yqhht
TLSH EE4423C512290B78411BAFC9B5FDCDF38F0C5E7948A52BE4F961C4A2095788C3379ADA
Reporter abuse_ch
Tags:AgentTesla TNT uue


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-433879.us-west-1.nxcli.net
Sending IP: 173.249.144.89
From: TNT EXPRESS <service@tnt.com>
Subject: Consignment Notification: Confirm Shipping Address
Attachment: Consignment Document PLBL Draft.uue (contains "Consignment Document PL&BL Draft.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:42:05 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m5mro5mhg7bjugosbznyeskdhhlppa3fx4r4g3cdihpfyqxo3fzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue 675917758737c29a19d20e5b82494339d6f78365bf23c36c4341de5c42eed973

(this sample)

AgentTesla

Executable exe a5ef8784ee005b194fa7317ed299cf0457c84b9a7a0ffb8c8c51fe8252c2b6d6

  
Dropping
MD5 8b79f525e62e0851e2331c9cd444861c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a5ef8784ee005b194fa7317ed299cf0457c84b9a7a0ffb8c8c51fe8252c2b6d6

Comments