MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 214345be85a0c0e9708aa9570cc13ddbc7e5d213e8e792d872440e86314715cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 214345be85a0c0e9708aa9570cc13ddbc7e5d213e8e792d872440e86314715cc
SHA3-384 hash: e6f828350d842516893fcf11d250bff54f10efee80a22a668a45742413fc4dd8569d6873e11f8f266151cab25f8c3cf4
SHA1 hash: 65e7c174313a44c7f7e41de063494325638bee39
MD5 hash: c9d02ce83583b76dd383bc5295bdbb7e
humanhash: muppet-dakota-oranges-bakerloo
File name:Shipping Details_PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:355'544 bytes
First seen:2020-11-20 06:37:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:CKVxxr4siqOVrB8IU0gU2MCxLw389lupiP9JRSJzHbLKrc5I6RQ1dJIb9wALkLh3:Coxxr4PrfBgZfc389lu+uaUqJkULF
TLSH 0E74232CC32842F0A2AEF4AE25255C4551E7CBF47FC097DA497B76F0F8AB2216E76450
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""TNT Express" <service@tnt.com>" (likely spoofed)
Received: "from zoz0.218.xzov.ml (zoz0.218.xzov.ml [161.35.53.134]) "
Date: "Thu, 19 Nov 2020 22:12:47 -0800"
Subject: "TNT AWB:1668788356"
Attachment: "Shipping Details_PDF.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/214345be85a0c0e9708aa9570cc13ddbc7e5d213e8e792d872440e86314715cc/
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 06:38:04 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=efbulpufudaos4ekvflqzqj53pd6luqt5dtzfwdsiqhimmkhcxga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 214345be85a0c0e9708aa9570cc13ddbc7e5d213e8e792d872440e86314715cc

(this sample)

AgentTesla

Executable exe f219aebbf79335831bca724a7b5e5039efb16b2ce3a5cdc3fdf6c31e8343f228

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f219aebbf79335831bca724a7b5e5039efb16b2ce3a5cdc3fdf6c31e8343f228
  
Dropping
AgentTesla

Comments