MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6156f0d394e75a5b11ff962cf488987b6fe6378b3bc0b77de8067d5f97ef39c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6156f0d394e75a5b11ff962cf488987b6fe6378b3bc0b77de8067d5f97ef39c
SHA3-384 hash: 85ad07764264ad6d287399dcf2856dd8aa0a9b18c3f3646171ac5b8a1c92e1e1afde33b438ff32c6a31c590404625539
SHA1 hash: 46ecf70cceb45b617c49a220bf9cb35b476dace8
MD5 hash: c0ea49cf2b0cf2de7e92143a75892503
humanhash: early-romeo-cardinal-alpha
File name:Recibo da TNT shipping.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:455'891 bytes
First seen:2020-11-07 10:19:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:9SKZkkyGl39/OOA1u7P2engpKoojSN6PGCMSyFv6T:ukyc/3A1wBQ9NVtzBK
TLSH 59A423B921A3A25FF3EEDB389BDB87585AFE7C304FB5D481430E1327854586A61E81C4
Reporter abuse_ch
Tags:AgentTesla geo PRT TNT zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.tnt.com
Sending IP: 185.239.242.114
From: myTNT <reply@mail.tnt.com>
Subject: Notificação de transferência de TNT
Attachment: Recibo da TNT shipping.zip (contains "Recibo da TNT shipping.exe")

AgentTesla SMTP exfil server:
mail.cosur.pe:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BackDoor.SpyBotNET.25.3911.4845.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6156f0d394e75a5b11ff962cf488987b6fe6378b3bc0b77de8067d5f97ef39c/
Threat name:
Win32.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 21:55:43 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ykw6djzjz22lmi77frm6sejq63p4y3ywo6aw566qbt5l6l66ooa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e6156f0d394e75a5b11ff962cf488987b6fe6378b3bc0b77de8067d5f97ef39c

(this sample)

AgentTesla

Executable exe cf0bad09c814bb64da93ebdb2ef5830c3b83e5106ae967e2155ebae2f2c63cc3

  
Dropping
MD5 a39eb134c963ff450009962b24819629
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf0bad09c814bb64da93ebdb2ef5830c3b83e5106ae967e2155ebae2f2c63cc3

Comments