MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65ce60f5cb81a786e1e9d336526c39039ce940752f01a827fddd7f5e7e2241b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65ce60f5cb81a786e1e9d336526c39039ce940752f01a827fddd7f5e7e2241b2
SHA3-384 hash: 7afa46e85219c12160e1aad47e4c5ad2c248d81b427012afc35bc486423f2293c6093f1c7bb63427adff0632979effe1
SHA1 hash: 45a999af5bc9851c7c70571a0d19c7dd43502b88
MD5 hash: f350e06ef3a14bcdae21a5ffb5c14e0c
humanhash: golf-utah-triple-pennsylvania
File name:Image001____________.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:428'872 bytes
First seen:2020-08-03 07:07:02 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:Dq4psHNHS3AfmHN/trgNBQI2Yep40CXLUGU8:JsHQQuHrrgNaYepR6
TLSH 199423C6633C7DCCD8FE32EEA322B99C15AAF0B7576CE45A49C1C414AF255175218F09
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: midea.com
Sending IP: 185.222.57.165
From: Philippe Lee <philippe.li@midea.com>
Subject: Re: Transfer Confirmation 100241703
Attachment: Image001____________.gz (contains "Image001____________.exe")

AgentTesla SMTP exfil server:
smtp.muziris.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200803-0839.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65ce60f5cb81a786e1e9d336526c39039ce940752f01a827fddd7f5e7e2241b2/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 01:58:13 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mxhgb5olqgtynypj2m3fe3bzaooosqdvf4a2qj753v7v47rcigza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/65ce60f5cb81a786e1e9d336526c39039ce940752f01a827fddd7f5e7e2241b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 65ce60f5cb81a786e1e9d336526c39039ce940752f01a827fddd7f5e7e2241b2

(this sample)

AgentTesla

Executable exe b3770ed7e40082d700739a98f8be9a3a338be55580942c0baddc5f03e03e5a63

  
Dropping
MD5 9c5bde5cf326a146fc1c58d2829571b5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3770ed7e40082d700739a98f8be9a3a338be55580942c0baddc5f03e03e5a63

Comments