MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca34a3ecccbc0a6ebe645b67c3642b94b3c27f42af07588ac5ffde0e7fff3d65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca34a3ecccbc0a6ebe645b67c3642b94b3c27f42af07588ac5ffde0e7fff3d65
SHA3-384 hash: aa73c81c4a065a72e458db2dd96f0cb188159181afde9170fe5288ab879bd33ea3b6afc32aae0775a9cf68ec96cae730
SHA1 hash: 9d345ebd8d7123dfacf4ed8a1bd894cd92ec181a
MD5 hash: 7e4f4e77d9a1da393eb8442f936da213
humanhash: orange-zebra-early-delta
File name:AWB & Invoice -TNT Shipment.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:556'825 bytes
First seen:2020-08-12 07:07:32 UTC
Last seen:2020-08-12 07:08:12 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:5kGF0/Kd8pdnPmNsKjllZbDV8bzrL12yF1hO1vyGcN:GG2/Kd8pdnPmKKjHZl8bhdF1hevO
TLSH FAC4231E8473DE3EA09B7E57EF75A4D20043121980E13B577D2217A325BDCAC998E7B2
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: Ritu Arora <ritu_arora@tnt.com>
Received: from tnt.com (unknown [37.48.85.197])
Date: 03 Aug 2020 05:29:08 -0700
Subject: TNT SHIPMENT
Attachment: AWB & Invoice -TNT Shipment.rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca34a3ecccbc0a6ebe645b67c3642b94b3c27f42af07588ac5ffde0e7fff3d65/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 06:00:23 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zi2kh3gmxqfg5ptelnt4gzblssz4e72cv4dvrcwf77pa4777hvsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ca34a3ecccbc0a6ebe645b67c3642b94b3c27f42af07588ac5ffde0e7fff3d65

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ca34a3ecccbc0a6ebe645b67c3642b94b3c27f42af07588ac5ffde0e7fff3d65

(this sample)

AgentTesla

Executable exe 77e7fb63d8ead8a0eb26e033cba63599507028ca5a12ea6439f0cf8f9e52d5ce

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77e7fb63d8ead8a0eb26e033cba63599507028ca5a12ea6439f0cf8f9e52d5ce
  
Dropping
AgentTesla

Comments