MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbfa1fc931cc9780a442228ce6ac46d68f4242153ee4dbd24bdf7d753188e185. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbfa1fc931cc9780a442228ce6ac46d68f4242153ee4dbd24bdf7d753188e185
SHA3-384 hash: eb85df210c375d123f0cdfdfc1c6c718b0b67beb645315ecda9f90bf24f7d559d8cf4cee0d30ed9a672471acfccd3e25
SHA1 hash: efe1e7b2c7db5cea05f5b7c105d26bbbb5dd25cb
MD5 hash: 68a05a9e3757005a7b76d1bb0acb71c5
humanhash: butter-montana-floor-failed
File name:TNT Consignment for 7048397463 Details.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:451'494 bytes
First seen:2020-10-02 09:00:14 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:zOI96t/qSwu6rGzQmepQMlrZa8HDA7+8iQy:zuqSwuUQwrbM7hiQy
TLSH 92A423937352D304C19EA7AB4692F99FF27313A2EF22174CEB731194E4A1E9E729C540
Reporter abuse_ch
Tags:AgentTesla gz TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: se4h-iad1.servconfig.com
Sending IP: 173.231.241.38
From: TNT Express <noreply@tnt.com>
Reply-To: civiananthony@gmail.com
Subject: TNT Consignment for 7048397463
Attachment: TNT Consignment for 7048397463 Details.gz (contains "TNT Consignment for 7048397463 Details.exe")

AgentTesla SMTP exfil server:
mail.groupedhb.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dbfa1fc931cc9780a442228ce6ac46d68f4242153ee4dbd24bdf7d753188e185/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-02 08:31:46 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3p5b7sjrzslybjccekgonlcg22hueqqvh3snxusl356xkmmi4gcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/dbfa1fc931cc9780a442228ce6ac46d68f4242153ee4dbd24bdf7d753188e185

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz dbfa1fc931cc9780a442228ce6ac46d68f4242153ee4dbd24bdf7d753188e185

(this sample)

AgentTesla

Executable exe 1b9451e9b76e1ca8efb1139b25e035ebc9fd9a4c5aebd9d5651b27828d3b6241

  
Dropping
MD5 355bad609265bae95a6834b7dd69cd93
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b9451e9b76e1ca8efb1139b25e035ebc9fd9a4c5aebd9d5651b27828d3b6241

Comments