MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c90c5878509ed3f1a395ff9e691884d4d97056ca133082ec087b31c9a10e61ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c90c5878509ed3f1a395ff9e691884d4d97056ca133082ec087b31c9a10e61ed
SHA3-384 hash: 2295fd3bd42b865d5ba29289b6e9f19104be0ebdf28a332fcc3469191d88d5fa44b70f272f71d17ebd30637c0f4a3b8e
SHA1 hash: 863f7fd89ec2172acfc632d63ba2f4c131ff2466
MD5 hash: f9c906f00e440cb81d88f1758a0d83b6
humanhash: arkansas-lamp-leopard-oscar
File name:PACKING LIST PL-1070957 BILL OF LADING BLI-170685.PDF.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'031'616 bytes
First seen:2020-10-24 10:33:09 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:piL13NGFYTyO/J1axFAZoqNPR4dCJlkHOSyxN0E3jJze:YFNGFAtJ4zGP/ZbxN0E3jJze
TLSH 11954A9D3660B6DFC867C972DEA81C24EB90787B431BD203A05311ADAA4E95BDF141F3
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: imc.es
Sending IP: 83.149.84.75
From: Logistic Manager <a.beltran@imc.es>
Subject: PACKING LIST -170957 & BILL OF LADING #BLI-170685 / Departure 27th OCT 2020
Attachment: PACKING LIST PL-1070957 BILL OF LADING BLI-170685.PDF.IMG (contains "j2iaLu4g16dYbel.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis521FA020CDBF.6051.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c90c5878509ed3f1a395ff9e691884d4d97056ca133082ec087b31c9a10e61ed/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-24 08:17:53 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zegfq6cqt3j7di4v76pgsgee2tmxavwkcmyif3aipmy4tiiomhwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c90c5878509ed3f1a395ff9e691884d4d97056ca133082ec087b31c9a10e61ed

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img c90c5878509ed3f1a395ff9e691884d4d97056ca133082ec087b31c9a10e61ed

(this sample)

AgentTesla

Executable exe 1e89ff960f161816b8b30fa8a1c75401cc3b9a7554c99cf9dda142712dd81e54

  
Dropping
MD5 521fa020cdbf788675abbc0e772ff71d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e89ff960f161816b8b30fa8a1c75401cc3b9a7554c99cf9dda142712dd81e54

Comments