MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d055d5b0033f3842863f8461828717ad52cf2cf402a6fd540752cf7b88205f33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d055d5b0033f3842863f8461828717ad52cf2cf402a6fd540752cf7b88205f33
SHA3-384 hash: c88b709019a9ba2542e6081a1f0aff3bdec8770e83653228824fb17701eded95c46e3fc78197c2486e91ca45f6b1285b
SHA1 hash: f796d2ffe4756ee06d62ddb95b1382d97ed047d6
MD5 hash: 88a89563787acdb81c05ff78cf1db699
humanhash: oranges-twenty-fix-charlie
File name:BL_ BGI-O-10706858 and BGI-O-10709887.PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'703'936 bytes
First seen:2020-10-18 06:33:55 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:ye8L+P6MgOPvzv2OJj2XqNL3En3iYi0Xj0O:/Z6YPvzvRtZNQZY
TLSH F475E69C365076DFC45BC872DAA81C64EBA07C7A831BC203A05336AD9E6D997DF144F2
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: euroasiachem.com
Sending IP: 83.149.106.1
From: RYVAN UZMA <uzma.euroasia@euroasiachem.com>
Subject: BILL OF LADING_# BGI-O-10706858 and BGI-O-10709887
Attachment: BL_ BGI-O-10706858 and BGI-O-10709887.PDF.img (contains "YTLFsQdK4Hb0Qse.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.1586.24182.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d055d5b0033f3842863f8461828717ad52cf2cf402a6fd540752cf7b88205f33/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-18 03:47:48 UTC
AV detection:
16 of 27 (59.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2bk5lmadh44efbr7qrqyfbyxvvjm6lhuaktp2vahklhxxcbal4zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/d055d5b0033f3842863f8461828717ad52cf2cf402a6fd540752cf7b88205f33

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d055d5b0033f3842863f8461828717ad52cf2cf402a6fd540752cf7b88205f33

(this sample)

AgentTesla

Executable exe 8f28bf16d28e463f009f14d0fdbd022ce9efd486666be096665ab84ab5fedf47

  
Dropping
MD5 7f86cf4be708f18d8d51c2c7c7225ec0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8f28bf16d28e463f009f14d0fdbd022ce9efd486666be096665ab84ab5fedf47

Comments