MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e787b0f7da3e67e447dcaaffe882c3f6f417ff5774976a9be5a9186d4f5392af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e787b0f7da3e67e447dcaaffe882c3f6f417ff5774976a9be5a9186d4f5392af
SHA3-384 hash: cfb6ca46df3308c8e874da5ca3ee056892f384c059192f376988e63cd9a6dbda70b1e03b7ebca469b05cbc171de382e5
SHA1 hash: 2fb9097065a8f1f95e63bfc0983f742f52fe6735
MD5 hash: efe59b832584cde9fde62d2695e6cc12
humanhash: equal-monkey-happy-blue
File name:DOC (CI,COO,PL,BL).r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:556'386 bytes
First seen:2023-04-20 06:58:06 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:V4YWctEB24VWNAyLj9ldfRud2P9uVjQ9mFdewyEDVq3fnoH5LU1G:VfhEBjWmyLj9l3udhk9mTXPD4fn45
TLSH T1A4C4239D77792740F7F5DA1687006F0FBF07C6AF08A380D426A8A46003CF59ADAE6365
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla Maersk r00 Shipping


Avatar
cocaman
Malicious email (T1566.001)
From: "Shirley.huang<Shirley.huang@lns.maersk.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.61]) "
Date: "20 Apr 2023 02:22:28 +0200"
Subject: "RE: SHIPPING DOC (CI,COO,PL,BL)"
Attachment: "DOC (CI,COO,PL,BL).r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:DOC (CI,COO,PL,BL).exe
File size:736'768 bytes
SHA256 hash: 1064b8d7d62b59ea9a8cda85d62e0ecef3c9e611a11625869ddcd6f0a4e9ad60
MD5 hash: 45798057e4c48924b02fdfc59822d9aa
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20230419-2233.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/6440e2b7cf53491c998880d7/reports/23ad52db-c35c-4813-9171-36cdf4eb76d7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e787b0f7da3e67e447dcaaffe882c3f6f417ff5774976a9be5a9186d4f5392af
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e787b0f7da3e67e447dcaaffe882c3f6f417ff5774976a9be5a9186d4f5392af/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=46d3b562hzt6ir64vl76rawd632bp72xoslwvg7fvemg2t2tskxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.41
Link:
https://yomi.yoroi.company/submissions/e787b0f7da3e67e447dcaaffe882c3f6f417ff5774976a9be5a9186d4f5392af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MSIL_SUSP_OBFUSC_XorStringsNet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:msil_susp_obf_xorstringsnet
Create hunting rule
Author:dr4k0nia
Description:Detects XorStringsNET string encryption, and other obfuscators derived from it
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 e787b0f7da3e67e447dcaaffe882c3f6f417ff5774976a9be5a9186d4f5392af

(this sample)

AgentTesla

Executable exe 1064b8d7d62b59ea9a8cda85d62e0ecef3c9e611a11625869ddcd6f0a4e9ad60

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1064b8d7d62b59ea9a8cda85d62e0ecef3c9e611a11625869ddcd6f0a4e9ad60
  
Dropping
AgentTesla

Comments