MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd01cc1dd10e7936eeeefc7eca37e1fb7bb83c0f3a8c2f9d48c1734666379c32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd01cc1dd10e7936eeeefc7eca37e1fb7bb83c0f3a8c2f9d48c1734666379c32
SHA3-384 hash: caa747fb7a8905f1315d59f0bfaaf1d1780554c575839d3adcdccbb17b8f874cd5caba4f4ab4ac470622a9f8b11a9c9a
SHA1 hash: 749360b217d39ab143d16129d62b7ba67a03c3fb
MD5 hash: a018b14c6e64a36f118dbbfaa8d2b331
humanhash: yellow-ink-white-fifteen
File name:BL-HBl -Tianjin - Loading- TJ20070006.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:106'466 bytes
First seen:2020-10-15 10:35:56 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 1536:2oB+BPbd/yO/ofujMsdWS5eyF+q6zQZpeZtiHvZR0yKM6zffdzAVt3Ye4Q2mxd4r:EvcsX5bgZUjeSPZWyKM4HdzuJLd2uK
TLSH F4A312D94CAAE832074DD85DCCE27E471246B0F384E58B0E1E728D162BB71B9429759B
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: brillbrains.in
Sending IP: 172.104.46.63
From: Zhang 运输 <admin@gippy.net>
Subject: 运输 Bill of Lading/ Packing - TIANJIN - TJ20070006
Attachment: BL-HBl -Tianjin - Loading- TJ20070006.xz (contains "BL-HBl -Tianjin - Loading- TJ20070006.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd01cc1dd10e7936eeeefc7eca37e1fb7bb83c0f3a8c2f9d48c1734666379c32/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 18:03:50 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xua4yhorbz4tn3xo7r7mun7b7n53qpaphkgc7hkiyfzumzrxtqza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bd01cc1dd10e7936eeeefc7eca37e1fb7bb83c0f3a8c2f9d48c1734666379c32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz bd01cc1dd10e7936eeeefc7eca37e1fb7bb83c0f3a8c2f9d48c1734666379c32

(this sample)

AgentTesla

Executable exe 2adb3505038e73bc83e5c5d9a60b725645fb65a7b0a781a5aadde50c942d13dc

  
Dropping
MD5 518cc76661b3b01e445035f037cee1f4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2adb3505038e73bc83e5c5d9a60b725645fb65a7b0a781a5aadde50c942d13dc

Comments