MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80ed1ca89068db25367eddbc475459a1b62c48f389297d047ec72851f53f04e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80ed1ca89068db25367eddbc475459a1b62c48f389297d047ec72851f53f04e0
SHA3-384 hash: 9163369c2529f0ffd32771f15360e08d8b6909355e8a6183c524cadf4f9d2ee50c82024854a278e50fc7eafa2a73cffa
SHA1 hash: c7b0a06c0e4bf0ca9c7618f273c583b8b3a52206
MD5 hash: 495b3e97e7d8e8ffb973c7f530480769
humanhash: three-seven-wisconsin-video
File name:Consignment Documents PLBL Draft.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:270'599 bytes
First seen:2020-05-18 06:33:46 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:FJn6ou8K2MJSwbTaxwLIn6cLx1iOBUSHWd0I6GBE+kNvQky:FJ6outSzKInNX1OSH0v9bkNYky
TLSH 7A4423557A5233F2E724086F82B3FDDBC1FC5A6FDFA20142A105861BB161573390EDAA
Reporter abuse_ch
Tags:AgentTesla r00 TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-162094.uk-south-2.nxcli.net
Sending IP: 165.84.219.70
From: TNT EXPRESS <service@tnt.com>
Subject: Consignment Notification: You have A Package With Us
Attachment: Consignment Documents PLBL Draft.r00 (contains "Consignment Documents PL&BL Draft.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 22:27:00 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qdwrzkeqndnsknt63w6eovczug3cyshtreux2bd6y4ufd5j7atqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 80ed1ca89068db25367eddbc475459a1b62c48f389297d047ec72851f53f04e0

(this sample)

AgentTesla

Executable exe 6b5edad4bbcfddc3fdc0470a560141bcec29941f860d5b149306d2c6e6b7718f

  
Dropping
MD5 6d3da3eba5d815927b08b3e2304c633f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6b5edad4bbcfddc3fdc0470a560141bcec29941f860d5b149306d2c6e6b7718f

Comments