MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf83fed9a8da6c4feafb219898f443fd3fa74886decc2aaf22403242deaf0da3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf83fed9a8da6c4feafb219898f443fd3fa74886decc2aaf22403242deaf0da3
SHA3-384 hash: b218750022993dd3f9da3adb2112cafd3cdbf19c4e80622341befb7e153de413a498ca578ee62d4e9ff650fb972ff6af
SHA1 hash: b84273fbe20d57823d34ba614580a2fa4a0e09f3
MD5 hash: 9629c03dfb3b1ea9281c8823e80a24d3
humanhash: florida-lion-september-sodium
File name:TNT Import Clearance Consignment 9066721066.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:605'884 bytes
First seen:2020-08-04 11:16:09 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:SFHWtkU0VyvLx/HEPPRJGwXZEDsfMY/nsO61sYbOOWlZJ31:aHWG9OLx/HEPZJbgm69bTWl5
TLSH FDD42382C62FD221D3AF1B532CE678B0B85CB35D8B552B756B8583C70A4C1BE07E5D1A
Reporter abuse_ch
Tags:7z AgentTesla TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: h3.plesklogin.net
Sending IP: 208.67.23.101
From: TNT Express Import Service <hani.elsayed@esweco.com>
Subject: TNT Import Clearance – Consignment : #9066 721066 is now under clearance process
Attachment: TNT Import Clearance Consignment 9066721066.7z (contains "TNT Import Clearance Consignment 9066721066.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf83fed9a8da6c4feafb219898f443fd3fa74886decc2aaf22403242deaf0da3/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:18:06 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x6b75wni3jwe72x3egmjr5cd7u72oseg33gcvlzciazefxvpbwrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bf83fed9a8da6c4feafb219898f443fd3fa74886decc2aaf22403242deaf0da3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z bf83fed9a8da6c4feafb219898f443fd3fa74886decc2aaf22403242deaf0da3

(this sample)

AgentTesla

Executable exe 3dc5c8e233e9889ee972466520a8db5a57b8482a01803d3870e2ec6aa33fdfdc

  
Dropping
MD5 9403e170530a6ebadeecb506bf6f722f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3dc5c8e233e9889ee972466520a8db5a57b8482a01803d3870e2ec6aa33fdfdc

Comments