MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08ef33dfef9ce4b362eca4964cb3fd3345688de2e45a3aae2d26dcfda45b93a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08ef33dfef9ce4b362eca4964cb3fd3345688de2e45a3aae2d26dcfda45b93a2
SHA3-384 hash: b8421ebdbed8a2fa68d014cfce090ad7a7281c424d322861234885b35e8fd55711e7c511530ae6c1ff5b5016cf07ffaa
SHA1 hash: 9f9b048b9f85f69cec1797aaab64a44d319c1875
MD5 hash: b967722c59b654c6629f40b5d567be34
humanhash: dakota-mississippi-item-two
File name:MV HONGSHENG 7 PDA.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:14'746 bytes
First seen:2021-04-05 06:31:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:o/s5ybCWOCVWNdabSTuo/KYmPqO3P0RUajXklTIjfM28ZTv:2yybCYoNdmho/KlPReXbEMjUpTv
TLSH 8462C107DF5D376BEF21343C108F57247981250AE9496348E697A4B9AC977BA0AF1F80
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gac.com
Sending IP: 103.99.1.148
From: Gac Shipping Cochin <shipping.cochin@gac.com>
Subject: MV HONGSHENG 7 / PORT ENQUIRY FOR LOADING 20000MT STL CARGO AT CHENNAI (GAIN0281500E)
Attachment: MV HONGSHENG 7 PDA.zip (contains "MV HONGSHENG 7 PDA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen13.2826.23751.12337.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/08ef33dfef9ce4b362eca4964cb3fd3345688de2e45a3aae2d26dcfda45b93a2
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08ef33dfef9ce4b362eca4964cb3fd3345688de2e45a3aae2d26dcfda45b93a2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-05 06:31:31 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdxthx7pttslgyxmuslezm75gncwrdpc4rndvlrne3op3jc3sora._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/08ef33dfef9ce4b362eca4964cb3fd3345688de2e45a3aae2d26dcfda45b93a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 08ef33dfef9ce4b362eca4964cb3fd3345688de2e45a3aae2d26dcfda45b93a2

(this sample)

AgentTesla

Executable exe 1103c8bce611da075ffa20426295a4f84b2409378c774dc32ca9edf968cd8a29

  
Dropping
MD5 b7a9f6dbd9f853af91f2efe391e8be04
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1103c8bce611da075ffa20426295a4f84b2409378c774dc32ca9edf968cd8a29

Comments