MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e80dc827fa0a1a1c46cfa68802bd255f0aa7a26d723f001a51920a42b2e99ba8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e80dc827fa0a1a1c46cfa68802bd255f0aa7a26d723f001a51920a42b2e99ba8
SHA3-384 hash: e584ad515e0f4558029f05f768ad31fa373a2777144b7d4cbb1627a48aa4defafecb744655a00b117da79f967469bb0d
SHA1 hash: 9ec75ee58ae3a282003f7288323c05368708f1eb
MD5 hash: 0b9c9ac313874cd7672e23b94a92a8d5
humanhash: yankee-illinois-double-twenty
File name:Shipping_Documents.img.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:496'073 bytes
First seen:2020-10-28 15:12:52 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:Gt4DGnEACIhHeko1ke6ePeS7umeM93Xq0UFr:G+DGnEAC2yeS7ua9nq02
TLSH 50B4237CB75BDD01972131CC1BEAA34D11640AF827CAEB2B9E8B4A156E9134A4373FD4
Reporter abuse_ch
Tags:7z AgentTesla TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tnt-express.com
Sending IP: 103.138.109.101
From: TNT EXPRESS <shipping@tnt-express.com>
Subject: FW: Consignment Notification: You have A Package With Us
Attachment: Shipping_Documents.img.7z (contains "Shipping_Documents.exe")

AgentTesla SMTP exfil server:
smtp.mivante.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.3832.27957.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e80dc827fa0a1a1c46cfa68802bd255f0aa7a26d723f001a51920a42b2e99ba8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 09:22:20 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ag4qj72binbyrwpu2eafpjfl4fkpitnoi7qagsrsifefmxjtoua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z e80dc827fa0a1a1c46cfa68802bd255f0aa7a26d723f001a51920a42b2e99ba8

(this sample)

AgentTesla

Executable exe 9efe8cef3127a10a3c0ee380a77298650e7a54e9e785d86f9871c00c2ad62bdf

  
Dropping
MD5 46d3cd2cfd03f9fdae5bb8f40bd52014
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9efe8cef3127a10a3c0ee380a77298650e7a54e9e785d86f9871c00c2ad62bdf

Comments