MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4ce47da901bbddba111d2ed210c0619b58e5360477edbf91cb8e292c88a8ab3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4ce47da901bbddba111d2ed210c0619b58e5360477edbf91cb8e292c88a8ab3
SHA3-384 hash: 0705808d49b88edb7c1703d6ff8e88b00571c096b9ac263bcea544f21a329823e6d68dad677db8f67d18edba40ee76fd
SHA1 hash: fcf76df3be9394afa746a0f989631ddb6f2f186b
MD5 hash: 7c87fd3db84536893644c9424801ae33
humanhash: jig-rugby-beer-pip
File name:MAERSK BILL OF LADING DOCS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:616'893 bytes
First seen:2020-11-14 18:36:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:D98HQ5TQYsR/VEK3Q2/E93D3SbRn7W2XVz6WkXPBRKj765j9Ju9MR7XHuiY:KHQCYsR/qwE9z3SbRZlzmDKIRkMRDrY
TLSH 8ED42348683D6E828FB9C378D8A2CACF93DA05F77D5D1D87AD87D850908670066CF627
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Maersk Customer Service <cindy.lu@maersk.com>" (likely spoofed)
Received: "from lsitms.net (mail.lsitms.net [50.31.168.75]) "
Date: "Sat, 14 Nov 2020 10:43:34 -0500"
Subject: "Longstanding Container(s) : 204103842"
Attachment: "MAERSK BILL OF LADING DOCS.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
276
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4ce47da901bbddba111d2ed210c0619b58e5360477edbf91cb8e292c88a8ab3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 14:48:57 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2thepwuqdo65xiir2lwscdagdg2y4u3ai57nx6i4xdrjfsekrkzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4ce47da901bbddba111d2ed210c0619b58e5360477edbf91cb8e292c88a8ab3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d4ce47da901bbddba111d2ed210c0619b58e5360477edbf91cb8e292c88a8ab3

(this sample)

AgentTesla

Executable exe 05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823
  
Dropping
AgentTesla

Comments