MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1c2850851b3ff5ca30d5687c1090f7be7c872e7815e0652cfdbb9dabf39d5c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1c2850851b3ff5ca30d5687c1090f7be7c872e7815e0652cfdbb9dabf39d5c1
SHA3-384 hash: 4efb5e230ca2dc1eb5f450556cda923ee477ba8f02ef5c5d61dbb4ca2f303f214caae9311c51b9bc9cf6d798d1e04b21
SHA1 hash: be9e061980b1ce36172fdb004b6673a6332dc1f0
MD5 hash: de3cb97dd67ea39bff629d9e89493019
humanhash: south-seventeen-delaware-uncle
File name:BILL-LADIN999976-DRAFTCOPY.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:694'091 bytes
First seen:2020-08-28 05:53:03 UTC
Last seen:Never
File type: ace
MIME type:application/x-rar
ssdeep 12288:8hBf2+TmHsmpTZQx1CLGNPqK2+EIgTU3/GkXJDuKDEc78e1ZO1UA9SyAaQmqKfKY:w++ms8Kx1v8hzRTU3ekX5uKDf78e14bn
TLSH FFE4332CCA40193E259A3CFA461F1DA6EAFC1455776132C09DAF7B63D318D89C93B2C5
Reporter abuse_ch
Tags:ace AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.sunflowerpack.ga
Sending IP: 104.131.114.8
From: MAERSK LINE<info@sunflowerpack.ga>
Subject: URGENT TELEX RELEASE - RE Shipment Bill of lading 20170000112
Attachment: BILL-LADIN999976-DRAFTCOPY.ace (contains "BILL-LADIN999976-DRAFTCOPY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1c2850851b3ff5ca30d5687c1090f7be7c872e7815e0652cfdbb9dabf39d5c1/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 01:52:21 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yhbikccrwp7vziynk2d4ccipppt4q4xhqfpamuwp3o45vpzz2xaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c1c2850851b3ff5ca30d5687c1090f7be7c872e7815e0652cfdbb9dabf39d5c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace c1c2850851b3ff5ca30d5687c1090f7be7c872e7815e0652cfdbb9dabf39d5c1

(this sample)

AgentTesla

Executable exe d9de85befd2a9049c9cea121bd32279d960716c95faa879b2863bba74ed8489f

  
Dropping
MD5 41a6a21df1b6cdbf0a767323097820ac
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9de85befd2a9049c9cea121bd32279d960716c95faa879b2863bba74ed8489f

Comments