MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcca2b71be058054dd0b9393ab5b02a8ba569640fb96fe5d1629acccce179804. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcca2b71be058054dd0b9393ab5b02a8ba569640fb96fe5d1629acccce179804
SHA3-384 hash: 27423d16e71e87ba015488c7100cac6c93150e3270d47bd648d291a4c2dd595059c0fff3ef2ddfe52e0e863142d9c226
SHA1 hash: 8d921a1a8f687b0c405d273ddffc808529e1d8a3
MD5 hash: 71f0fc17c747b38fbb90c843475bb97f
humanhash: cat-mirror-white-bravo
File name:MV NAHIDE-M EDPA REQUEST FOR SHIPYARD CALL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:536'204 bytes
First seen:2020-08-18 13:20:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:MdIXLtsJQiXCQfsasy2Jp7AOByEkyIV51vvaDOh1qQp4NBAvm8oB6:S2AzS6sa32ko+9vaDObqU4NBAv3N
TLSH CAB433D285C5B975658C88BDAEF97EF8C2390EC65FB09B30444955C38F158F433AE168
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: swn0.719.zazomika.ml
Sending IP: 157.245.100.117
From: Panlink Shipping Agency(Jiangyin) Co.,Ltd <agency@panlnklogistics.com>
Reply-To: howardbrisson@gmail.com
Subject: MV NAHIDE-M // EDPA REQUEST FOR SHIPYARD CALL
Attachment: MV NAHIDE-M EDPA REQUEST FOR SHIPYARD CALL.rar (contains "MV NAHIDE-M EDPA REQUEST FOR SHIPYARD CALL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcca2b71be058054dd0b9393ab5b02a8ba569640fb96fe5d1629acccce179804/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 05:22:15 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3tfcw4n6awafjxilsoj2wwycvc5fnfsa7olp4xiwfgwmztqxtaca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dcca2b71be058054dd0b9393ab5b02a8ba569640fb96fe5d1629acccce179804

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar dcca2b71be058054dd0b9393ab5b02a8ba569640fb96fe5d1629acccce179804

(this sample)

AgentTesla

Executable exe e1117b5ae3e0424b17971fcd47d27d29f26f2bd40f5f899bdabcdcfa68a57e6d

  
Dropping
MD5 56f24734839645bc71d9e354413971b9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1117b5ae3e0424b17971fcd47d27d29f26f2bd40f5f899bdabcdcfa68a57e6d

Comments