MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83532bb6a24d4eb669d3655d94345e3b44df39025e8c4ad024d5365575a70fe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83532bb6a24d4eb669d3655d94345e3b44df39025e8c4ad024d5365575a70fe2
SHA3-384 hash: 71ada9de313932652cc474b190b3306c8dbba1f524b72aa3b5b6f05db63a18418851d9500ea47e875e05ae9b9e8428ce
SHA1 hash: c86fe34f3bce6094060d908dd725f0d5ed684731
MD5 hash: 6eaeb10b60ff1d30184145fa7b821c92
humanhash: harry-five-uranus-pasta
File name:MAERSK KLEVEN V.949.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'477'605 bytes
First seen:2020-08-13 10:56:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:LEH458+iflOBh/TqOb98xoCWBBFzghvdOUNm6GK1LMzzyIKfSgyXQlj6d0Dq2c91:L7aABlv98xIBBOhvdOH6GK9MzzrKfSgc
TLSH F86533EDFB7EDAB60E9E757418795E0A3613099AC5470BCF0277614229B036CC1ECB68
Reporter abuse_ch
Tags:AgentTesla Maersk zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: maersk.com
Sending IP: 103.125.191.170
From: A.P moller <henry.zong@maersk.com>
Subject: RE : URGENT!!! SHIPPING DOC BL,SI,INV#462345 // MAERSK KLEVEN V.949E
Attachment: MAERSK KLEVEN V.949.zip (contains "MAERSK KLEVEN V.949.exe")

AgentTesla SMTP exfil server:
mail.gammavilla.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.21eda5c3a9b012e0.31562.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83532bb6a24d4eb669d3655d94345e3b44df39025e8c4ad024d5365575a70fe2/
Threat name:
Win32.Trojan.MereTam
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 10:58:07 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qnjsxnvcjvhlm2otmvozinc6hncn6oicl2gevube2u3fk5nhb7ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/83532bb6a24d4eb669d3655d94345e3b44df39025e8c4ad024d5365575a70fe2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 83532bb6a24d4eb669d3655d94345e3b44df39025e8c4ad024d5365575a70fe2

(this sample)

AgentTesla

Executable exe f1f8cbfc6921ce73c2c3668b2fded2a1bdb3cf8d5434f23090840115188fd7b9

  
Dropping
MD5 21eda5c3a9b012e0ae18f446da1b9eeb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1f8cbfc6921ce73c2c3668b2fded2a1bdb3cf8d5434f23090840115188fd7b9

Comments