MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05f945e6aec9cba24cd197bd845e9f7d6b70b39b848b4770b7e23df89cee866d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05f945e6aec9cba24cd197bd845e9f7d6b70b39b848b4770b7e23df89cee866d
SHA3-384 hash: c4116c322f1311e4a34ba08f916cd62e129272fbddc9ba1143fd32fcf8090e61d22a12f292da8a4dc80241d52d25f871
SHA1 hash: d3bf47f6d998ea293d9a1f79b44df55917be33a4
MD5 hash: 018828f0ceafec0b0bbbf83754a7c9d7
humanhash: fruit-mobile-asparagus-arkansas
File name:Invoice.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:451'135 bytes
First seen:2020-08-13 05:31:44 UTC
Last seen:2020-08-13 05:41:19 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:UbEexhf6yEcrC6EBbIYwooN/vRavP56/s82GuveWDcpF:5+icWpBbIFo+WP56/Bzuv4
TLSH C5A4234016A8E69066E87BF11D36EC90A3DB24B9617241BDE82D87FECBCEB815270705
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Hershy Adler <accounts@sc.com>
Received: from sc.com (unknown [209.58.149.97])
Date: 12 Aug 2020 06:16:32 -0700
Subject: Re:The Reply From Bank
Attachment: Invoice.pdf.gz

Intelligence

File Origin
# of uploads :
5
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200813-0813.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05f945e6aec9cba24cd197bd845e9f7d6b70b39b848b4770b7e23df89cee866d/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 06:07:54 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
17 of 29 (58.62%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ax4ulzvozhf2etgrs66yixu7pvvxbm43qsfuo4fx4i67rhhoqzwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/05f945e6aec9cba24cd197bd845e9f7d6b70b39b848b4770b7e23df89cee866d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 05f945e6aec9cba24cd197bd845e9f7d6b70b39b848b4770b7e23df89cee866d

(this sample)

AgentTesla

Executable exe fb3509272ff65cf1f3521d230d912afde3af02dcf203ad045e020a4fd86ddca0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fb3509272ff65cf1f3521d230d912afde3af02dcf203ad045e020a4fd86ddca0
  
Dropping
AgentTesla

Comments