MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b00ccce0e53fb7d5d801a623f1b1b2a77399acdcc8bd782e46eef1bba6172749. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b00ccce0e53fb7d5d801a623f1b1b2a77399acdcc8bd782e46eef1bba6172749
SHA3-384 hash: cfb6253a8604218e024ea4549c34a4cdec14b6af7cd4ad6d5ff3633ccd5dcf4c23d74f770574576c2f2b93a55a2232cf
SHA1 hash: b8552ee78649a262c7877f4bc9e9b155bc686c9d
MD5 hash: 7fff0cffbaf24d768260e2c1497d7b11
humanhash: cola-arkansas-river-eleven
File name:Maersk Container Gurantee.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'463 bytes
First seen:2020-11-16 17:31:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:wcT6mDYsx5ci6Vv9ropgwtzNXlLRY766XxD:nTesx5A9kCgzDeD
TLSH 3E9423BF1347F19C3CCF9D9B824E8758AFE91A3EC4114526815CFA58E41F712AD9482B
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Maersk Line Cargo Services <cindy.lu@maersk.com>" (likely spoofed)
Received: "from lsitms.net (mail.lsitms.net [50.31.168.75]) "
Date: "Mon, 16 Nov 2020 03:23:08 -0500"
Subject: "Account statement & BL"
Attachment: "Maersk Container Gurantee.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b00ccce0e53fb7d5d801a623f1b1b2a77399acdcc8bd782e46eef1bba6172749/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 05:10:54 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wagmzyhfh635lwabuyr7dmnsu5zztlg4zc6xqlsg53y3xjqxe5eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b00ccce0e53fb7d5d801a623f1b1b2a77399acdcc8bd782e46eef1bba6172749

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b00ccce0e53fb7d5d801a623f1b1b2a77399acdcc8bd782e46eef1bba6172749

(this sample)

AgentTesla

Executable exe e038eadef4d510053ac68606d65745c3de396f3d6f5a2dce11fd03d1c72c42de

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e038eadef4d510053ac68606d65745c3de396f3d6f5a2dce11fd03d1c72c42de
  
Dropping
AgentTesla

Comments