MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14437a4f8e187be988cf51845a2e6341206c90e190bed7e09b0451ab06506c2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14437a4f8e187be988cf51845a2e6341206c90e190bed7e09b0451ab06506c2e
SHA3-384 hash: 08edcac54f0240d967951ce0146344c977753bc0f1b1733ceb8b4148ddf5374623ef56d960f9011e8fbaa6644d4e3336
SHA1 hash: 20c65632db54e3587f38538672c9285885128f46
MD5 hash: 89c9d3074083da94f0d923818450078c
humanhash: iowa-shade-ceiling-kilo
File name:TNT Shipping Documents.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'028'166 bytes
First seen:2022-02-01 12:18:22 UTC
Last seen:2022-02-01 12:21:39 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:82PrXibTl9wyozRZnfKQQiqSAXwuQx02tGZl8NYiINF/1MXbrdBCB:84wTOmbwAkACQeNBCB
TLSH T1382533D8E6A0F8040F857665C2B2520BB5BF12FD244E6692D1E10FE35FE890CF6670B6
Reporter cocaman
Tags:AgentTesla rar TNT


Avatar
cocaman
Malicious email (T1566.001)
From: "TNT Express <tnt@bvcxmna.sbs>" (likely spoofed)
Received: "from hp0.bvcxmna.sbs (unknown [161.35.12.114]) "
Date: "Tue, 01 Feb 2022 01:33:14 -0800"
Subject: "TNT Express delivery Consignment Notification"
Attachment: "TNT Shipping Documents.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61f9253918d1bfdde4e68850/reports/8ecf910c-fa0c-4fd7-b6c9-0aa89b279ba7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14437a4f8e187be988cf51845a2e6341206c90e190bed7e09b0451ab06506c2e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-01 06:56:56 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
12 of 42 (28.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=crbxut4odb56tcgpkgcfultdieqgzehbsc7npye3ari2wbsqnqxa._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220201-sdzcpagbdq/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/14437a4f8e187be988cf51845a2e6341206c90e190bed7e09b0451ab06506c2e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 14437a4f8e187be988cf51845a2e6341206c90e190bed7e09b0451ab06506c2e

(this sample)

AgentTesla

Executable exe 206de4a0a2b7641051642196fb7b8dd5fa4f26ff329725c124431ee561f465c6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 206de4a0a2b7641051642196fb7b8dd5fa4f26ff329725c124431ee561f465c6

Comments