MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee3ee78c9fbcf47e2f199a1d58df627289d96171b1a4cf35be0fbfd13db65cce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee3ee78c9fbcf47e2f199a1d58df627289d96171b1a4cf35be0fbfd13db65cce
SHA3-384 hash: d069e140866e624b44618369129a504a435fba9f076ba0bae8b8e4433663b244eaced9a3796e7f8f5291318feae39c5b
SHA1 hash: b8010602b52ed90436a2628308bccbcb10caf649
MD5 hash: 53e4bef060defd3143946de6798b79e2
humanhash: batman-chicken-pip-single
File name:MAERSK PACKING LIST DOCS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:616'891 bytes
First seen:2020-11-14 18:37:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:598HQ5TQYsR/VEK3Q2/E93D3SbRn7W2XVz6WkXPBRKj765j9Ju9MR7XHuiY:cHQCYsR/qwE9z3SbRZlzmDKIRkMRDrY
TLSH E6D42348683D6E828FA9C378D8A2CACF93DA05F77D5D1D87AD87D85090C270066CF627
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Maersk Customer Service <cindy.lu@maersk.com>" (likely spoofed)
Received: "from lsitms.net (mail.lsitms.net [50.31.168.75]) "
Date: "Sat, 14 Nov 2020 10:43:34 -0500"
Subject: "Longstanding Container(s) : 204103842"
Attachment: "MAERSK PACKING LIST DOCS.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee3ee78c9fbcf47e2f199a1d58df627289d96171b1a4cf35be0fbfd13db65cce/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 14:49:02 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5y7opde7xt2h4lyztiovrx3coke5sylrwgsm6nn6b675cpnwltha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee3ee78c9fbcf47e2f199a1d58df627289d96171b1a4cf35be0fbfd13db65cce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ee3ee78c9fbcf47e2f199a1d58df627289d96171b1a4cf35be0fbfd13db65cce

(this sample)

AgentTesla

Executable exe 05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823
  
Dropping
AgentTesla

Comments