MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecab7ef9ea4933a60ac021753ffac02c33c67766131de79c1a4d23680219a32d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecab7ef9ea4933a60ac021753ffac02c33c67766131de79c1a4d23680219a32d
SHA3-384 hash: 7f57e4cffce892c57d5d984bb16232ff543258091abb1cf0464614045512050a7edc9598ed18fdca7060aaef8bf58fcd
SHA1 hash: a781bb4a4b9e70bb3602bd9bd6e8c096f769665e
MD5 hash: 9f1a4a321ebbd3741cbf8c8002651c3b
humanhash: winner-quiet-monkey-michigan
File name:STOWAGE PLAN.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:484'466 bytes
First seen:2021-03-27 05:39:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:9MigizXiTFrW03rN7NMswwaKdu40xPfcNTn66zl5VcwhCpHspb:9wi+ZrL3p7/iT+Tn66zlUwh0ub
TLSH 8CA42303A324FBA283FC53472F3A6ED6D246A81A468C15171747AD29C63B9BB534670B
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "DA Dept.Roxana Shipping<da@roxanashipping.com>" (likely spoofed)
Received: "from roxanashipping.com (unknown [64.44.139.178]) "
Date: "26 Mar 2021 22:35:16 +0100"
Subject: "MT ATHIRI VOY 87 EPDA AND PORT INFO REQUEST"
Attachment: "STOWAGE PLAN.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecab7ef9ea4933a60ac021753ffac02c33c67766131de79c1a4d23680219a32d/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-26 23:08:54 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5svx56pkjez2mcwaef2t76wafqz4m53gcmo6pha2jurwqaqzumwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/ecab7ef9ea4933a60ac021753ffac02c33c67766131de79c1a4d23680219a32d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ecab7ef9ea4933a60ac021753ffac02c33c67766131de79c1a4d23680219a32d

(this sample)

AgentTesla

Executable exe 693838dc65163feeefd9b7f51d15efb32645977601ce33b5d1dd5a7f9c348532

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 693838dc65163feeefd9b7f51d15efb32645977601ce33b5d1dd5a7f9c348532
  
Dropping
AgentTesla

Comments