MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e31b9aa7e444e46077257bf9c82eda3355124a4a769fcb2e2d9627fbb129cb36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e31b9aa7e444e46077257bf9c82eda3355124a4a769fcb2e2d9627fbb129cb36
SHA3-384 hash: 61c0f5513c464209382d13ce398a88409b7105ffb1c8e2d7f0d45826fa8dd7f18c522aca3c22460f482bf724c521eb1e
SHA1 hash: 2fdd5472093bc05a38097d6b4a5a0075b4bfb109
MD5 hash: 5ec5d80adcfa392805d8c1512fe9f456
humanhash: triple-three-football-alanine
File name:Royauman PO_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:264'192 bytes
First seen:2020-11-13 09:46:31 UTC
Last seen:2020-11-13 09:47:12 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 3072:dvy4eFqGw9YHsASx66rKcwiKsyCXWW8H+P8Ox257prEAmjc+j98Y:XHNbFHYEAmg+h8
TLSH 5944493C6D845963D137A272A4B90182F9B56D8A72794C0F21CB3A093E7BF023D9774E
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Cherry Chan <purchase@royaumann.com.cn>" (likely spoofed)
Received: "from postfix-inbound-8.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "13 Nov 2020 01:34:55 -0800"
Subject: "Royaumann PO"
Attachment: "Royauman PO_pdf.img"

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.db50938cd1051c81.14429.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e31b9aa7e444e46077257bf9c82eda3355124a4a769fcb2e2d9627fbb129cb36/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 08:13:17 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4mnzvj7eitsga5zfpp44qlw2gnkressko2p4wlrnsyt7xmjjzm3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img e31b9aa7e444e46077257bf9c82eda3355124a4a769fcb2e2d9627fbb129cb36

(this sample)

AgentTesla

Executable exe 2f1f66a7d7f0058db7f854e5ed21829fcbc075a6a94590b16a1509267a477511

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2f1f66a7d7f0058db7f854e5ed21829fcbc075a6a94590b16a1509267a477511
  
Dropping
AgentTesla

Comments