MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60e19bc26b53326238485650ce52b07397963f303e0c8ac3ceb23301e52c2a42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60e19bc26b53326238485650ce52b07397963f303e0c8ac3ceb23301e52c2a42
SHA3-384 hash: b7165373e6ac90a8d19def4243dfe986c957280a9ccf86961e5ce414a5742f24ddd3aca5b34dc2e76c9d891fae7d6b71
SHA1 hash: e67bedc14e6b9a529becafe018f1101a954b08e6
MD5 hash: a9e0ce03838869f8cdfb4c1d152a6476
humanhash: pizza-cold-lake-violet
File name:IMG_PI S20080071.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:620'544 bytes
First seen:2020-08-11 12:25:57 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:7/U2MS6HBTR0fSyG62HdPkUisULO/Zxxc:Y79Tu1V2S+//xc
TLSH 6AD4E0A1B1156993C9B840F19516A14107A23C79F9B0F3F67CCEF3AB5BF37018626A27
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.unsubscribeasap.com
Sending IP: 198.102.14.18
From: ECANDES Sales Group <Sales@ecandes.de>
Subject: New Order ECANDES - August
Attachment: IMG_PI S20080071.img (contains "IMG_PI S20080071.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.a3d86f73edafe4c6.28830.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60e19bc26b53326238485650ce52b07397963f303e0c8ac3ceb23301e52c2a42/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-11 12:27:07 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mdqzxqtlkmzgeocikzim4uvqoolzmpzqhygivq6owizqdzjmfjba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/60e19bc26b53326238485650ce52b07397963f303e0c8ac3ceb23301e52c2a42

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 60e19bc26b53326238485650ce52b07397963f303e0c8ac3ceb23301e52c2a42

(this sample)

AgentTesla

Executable exe fe1ae654313a1525714c509f438b835f5ab342303c76f3cf7360a50043516493

  
Dropping
MD5 a3d86f73edafe4c67a10353b13252776
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe1ae654313a1525714c509f438b835f5ab342303c76f3cf7360a50043516493

Comments