MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36823ad29a11209348b7ce3d910c1401ee7d459dda281f279699706ca4995cae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36823ad29a11209348b7ce3d910c1401ee7d459dda281f279699706ca4995cae
SHA3-384 hash: 66a165daa3a16704bc5a18eba8404780860f803c36cdf6b9045bead783f5af79b2080091946475120e9c56a291238023
SHA1 hash: f58f1bdc689071661a76a0871f7f28877e2d8e72
MD5 hash: a4c7703cd3f73394ba30335b38df1ce0
humanhash: indigo-mars-maine-tennis
File name:DRAFT SHIPMENT DOCUMENTS CI,PL.BL.pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-21 08:30:40 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:dzM09TQTfOROZsmtXvptl75aLuAZX5g2JCZlAfwX23yuf1:NM09UTf3sOxaLX/gGCZ2fEu
TLSH 6E4502A853549A16E67E4B7C10A1221113B1E611AA57F78EBFDC30FE5F737A0870638B
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "Eduardo Vidal <evidal@inconcertcc.com>"
Received: "from mail.inconcertcc.com (mail.inconcertcc.com [200.40.135.117]) "
Date: "Wed, 21 Oct 2020 04:47:38 -0300 (UYT)"
Subject: "DRAFT BL 4600011062"
Attachment: "DRAFT SHIPMENT DOCUMENTS CI,PL.BL.pdf.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.17776.15986.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36823ad29a11209348b7ce3d910c1401ee7d459dda281f279699706ca4995cae/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 08:32:06 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g2bdvuu2ceqjgsfxzy6zcdauahxh2rm53iub6j4wtfygzjezlsxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 36823ad29a11209348b7ce3d910c1401ee7d459dda281f279699706ca4995cae

(this sample)

AgentTesla

Executable exe 699d6b825f4e477e4d9890f7c5d69ef6d157836a680e1427ebbedc6084a5ce9b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 699d6b825f4e477e4d9890f7c5d69ef6d157836a680e1427ebbedc6084a5ce9b
  
Dropping
AgentTesla

Comments