MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ce158641b216d79b4fcbc98f80096835bde7ca631ca6ccfebb9c851d9ec4700. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ce158641b216d79b4fcbc98f80096835bde7ca631ca6ccfebb9c851d9ec4700
SHA3-384 hash: c2acf5b4e792a77f193b3db772894436a8b35188bd301f83e7308b58f47c9b70bda07503956e758941bd4919bacbf1d6
SHA1 hash: 65e0fe0fed47e38353417ee78b696c6118984c73
MD5 hash: 89cd7216b9d3bb713611c76c651ae9ac
humanhash: pip-maine-april-river
File name:Swift-CopyInv8309829,jpg.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:619'158 bytes
First seen:2020-08-30 08:06:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:VJwRBT2tlasJwY1VUDBB/ufIF0DqAOdTOXBnWlCyFhdFhkGZsQXB7ZXQGmDt01EM:VIB6apYs/YIPAOdCxWlrhqQ7ZAG1HF
TLSH BED4235E87FF4082E4345A909388676E16FFD582DADE43B1E548B68102761F8EDDC0FA
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: backup.sap-express.com
Sending IP: 103.31.134.141
From: Asad Hussain <Asad.Hussain@adcb.com>
Subject: Payment Swift copy for #Inv8309829, for your confirmation
Attachment: Swift-CopyInv8309829,jpg.gz (contains "Swift-CopyInv8309829,jpg.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodGzip-A.28111.28549.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ce158641b216d79b4fcbc98f80096835bde7ca631ca6ccfebb9c851d9ec4700/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 06:54:40 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ltqvqza3efwxtnh4xsmpqaewqnn547fgghfgzt7lxhefdwpmi4aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ce158641b216d79b4fcbc98f80096835bde7ca631ca6ccfebb9c851d9ec4700

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5ce158641b216d79b4fcbc98f80096835bde7ca631ca6ccfebb9c851d9ec4700

(this sample)

AgentTesla

Executable exe 89b4bd8641b5e9a1e1f282486016fad6512b9630ad22c41472262ae1c4bdb894

  
Dropping
MD5 c39b203d8a019127118c2b590b1ccf90
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89b4bd8641b5e9a1e1f282486016fad6512b9630ad22c41472262ae1c4bdb894

Comments