MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b93dae9d22f61a67992e145f217014d6eba3c066fef6bb5aa201c7eb81fb5d0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b93dae9d22f61a67992e145f217014d6eba3c066fef6bb5aa201c7eb81fb5d0d
SHA3-384 hash: cb6d8a2102acb6ed714b1eabff2ad9c3c14eaadb6f76f8b87551cdeae16fed54dfa05a2c9ac80b06ec01a2ce4a9861e7
SHA1 hash: 6e24ee6ec38b4848800ff144191d1bfbe11a6319
MD5 hash: e6818b8ec668cf1c91102f8446a2e62d
humanhash: california-kansas-april-orange
File name:Original Invoice PL-DL Draft.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'311 bytes
First seen:2020-07-02 06:37:57 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:Fp/9xfeQ/iT+dYegzaPyQ0O6CcFK1nTRI/:FB9xfx/i71zqnTE
TLSH 5284230F8BBDA1E41E968DE57184C53D5CE0A049EDBB60EA6C9023C59CE6822F57F05B
Reporter abuse_ch
Tags:AgentTesla r00 TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-433832.uk-south-2.nxcli.net
Sending IP: 165.84.219.136
From: TNT EXPRESS <service@tnt.com>
Subject: CARGO ARRIVAL NOTIFICATION (TNT733918737WA): Logistics BL + PL +IVN
Attachment: Original Invoice PL-DL Draft.r00 (contains "Original Invoice PL-DL Draft.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b93dae9d22f61a67992e145f217014d6eba3c066fef6bb5aa201c7eb81fb5d0d/
Threat name:
ByteCode-MSIL.Trojan.Occamy
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 06:39:05 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xe625hjc6yngpgjocrpsc4au23v2hqdg733lwwvcahd6xap3lugq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 b93dae9d22f61a67992e145f217014d6eba3c066fef6bb5aa201c7eb81fb5d0d

(this sample)

AgentTesla

Executable exe 9399beca2249aa622d17718d9a7c3ac74984c12eed69d3028080d619d0323a2b

  
Dropping
MD5 edff804a24bdb8539b15f66e6a24557e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9399beca2249aa622d17718d9a7c3ac74984c12eed69d3028080d619d0323a2b

Comments