MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4cead9465c1e03aaad13e02e38b491675e8d13caa6ba290e979882fa16accec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4cead9465c1e03aaad13e02e38b491675e8d13caa6ba290e979882fa16accec
SHA3-384 hash: 722bf9d68ef0d1ba5bf72bb12e9a8d5c5c378c56ad5e3ee3f7dd3f706faeb8bb18a481e603d7b8304b9086787f2ef5ec
SHA1 hash: 1c45be41eca6ac772546ef119f45fb67674d06f0
MD5 hash: 93d2a7e61ae3f01207824fe035963451
humanhash: july-kentucky-march-tennis
File name:Consignment Document PL&BL Draft.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-11-03 06:23:47 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:Cu2Mo+Efv8I1zd5wIJH5y5bvDweMjYleUXnf/0Dl9Ory255:7Het1p5ZXylIAeAKl9iy
TLSH 46459E727D92546ECA6E07714069C5C0FABA1AC73F608B0D71AF530C1F21B1BAB6364B
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "TNT EXPRESS <Airene.Jovellanos@tnt.com>"
Received: "from vnv0.708.sfjido.ml (vnv0.708.sfjido.ml [143.110.157.241]) "
Date: "Mon, 02 Nov 2020 17:55:26 -0800"
Subject: "Consignment Notification: WB-260820200131222"
Attachment: "Consignment Document PL&BL Draft.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.1103.7561.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4cead9465c1e03aaad13e02e38b491675e8d13caa6ba290e979882fa16accec/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 01:23:09 UTC
File Type:
Binary (Archive)
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4thk3fdfyhqdvkwrhybohc2jcz26ruj4vjv2fehjpgec7ilkztwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e4cead9465c1e03aaad13e02e38b491675e8d13caa6ba290e979882fa16accec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img e4cead9465c1e03aaad13e02e38b491675e8d13caa6ba290e979882fa16accec

(this sample)

AgentTesla

Executable exe cd69ac65237b5e9280395b4faaf70447e6524d99801fdda8dfb62178f24f24b3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cd69ac65237b5e9280395b4faaf70447e6524d99801fdda8dfb62178f24f24b3
  
Dropping
AgentTesla

Comments