MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0b1b242140c6174aef28c2025d985b64fd088d59a081584d3737840551a625b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0b1b242140c6174aef28c2025d985b64fd088d59a081584d3737840551a625b
SHA3-384 hash: fd72980d9556b7bd0689c9b51d97f22aefb21b24142a0873d7a400660748d1069e239ee7ef4251ab7e89592edb6939bd
SHA1 hash: dbe8fede8729a45cbff742c625f615945d3755d6
MD5 hash: f9fec37d2298a5052ccccf3b695b5fad
humanhash: mirror-enemy-september-video
File name:Document_BT24PDF.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:919'552 bytes
First seen:2020-09-02 06:20:35 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:9SR5xenNnxM5jLBS3CB9vHmZ9+H4sJ6x72AJnXpTvNRkpLO+ToI5JIBPef1JLUtB:9SR5xensnBWNZ04NbXpjNRkpLO+t56
TLSH 1415BDAC72507A9EC527FD76C8131D2CE790A076D337E347E41711989A0DA97EF222E2
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: probalear.servidorplesk.com
Sending IP: 149.62.171.108
From: Olga Chirila <olga.chirila@mazarom.ro>
Subject: FW: Document - Banca Transilvania Op
Attachment: Document_BT24PDF.iso (contains "Document_BT24PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0b1b242140c6174aef28c2025d985b64fd088d59a081584d3737840551a625b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 05:55:24 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ycy3eqqubrqxjlxsrqqclwmfwzh5bcgvtieblbgton4eavi2mjnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c0b1b242140c6174aef28c2025d985b64fd088d59a081584d3737840551a625b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso c0b1b242140c6174aef28c2025d985b64fd088d59a081584d3737840551a625b

(this sample)

AgentTesla

Executable exe dc2d666c38ec7694f487798c8b9574d1e9f009c8c4d2a57a5ab1de6297adf855

  
Dropping
MD5 3ead6faca3c18c67d05953571d3b8d63
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc2d666c38ec7694f487798c8b9574d1e9f009c8c4d2a57a5ab1de6297adf855

Comments