MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4525d4fa7b4d52627eda8c2fbaab59897b0610e0a85cb738fc8e1a0bd4bf9f54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4525d4fa7b4d52627eda8c2fbaab59897b0610e0a85cb738fc8e1a0bd4bf9f54
SHA3-384 hash: 20927e4f97473b731fb505de963bfcb8b858d5d4f9f4faf7038183844b2b1f776140fc5ea4d31fb6f1a8a295a96c7868
SHA1 hash: b1a1eac1f3dd02c5a831e42a2adfda837dba9721
MD5 hash: 5cfc7265967c9f263899cfe8d122e10b
humanhash: fix-single-winner-seventeen
File name:PO#KAGP0018-PL&IV 48000115904800011599.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'003 bytes
First seen:2020-11-19 06:50:59 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:6BloNRwm7N8QuK/bgkibtf3+5lbGOhg9hA+M:sloDwJeskiRf3UlbGO2jM
TLSH B39423547EA1F4AAAC6E3752F7B0749F646121B306F3D9B7DDBC6C27227008060AE52D
Reporter cocaman
Tags:7z AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: "chengxin_xu <chengxin_xu@vip.163.com>" (likely spoofed)
Received: "from vip.163.com (unknown [45.137.22.52]) "
Date: "18 Nov 2020 18:05:47 -0800"
Subject: "=?UTF-8?B?UE8jS0FHUDAwMTgtMTEqNDBIUe+8jEVURCBTSEVOWkhFTiDvvJpFVEEgTUVMQk9VUk5F77yMU0/vvJoxS1QwMDExNTU=?="
Attachment: "PO#KAGP0018-PL&IV 48000115904800011599.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4525d4fa7b4d52627eda8c2fbaab59897b0610e0a85cb738fc8e1a0bd4bf9f54/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 03:53:40 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 29 (65.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ius5j6t3jvjge7w2rqx3vk2zrf5qmehavbolooh4rynaxvf7t5ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 4525d4fa7b4d52627eda8c2fbaab59897b0610e0a85cb738fc8e1a0bd4bf9f54

(this sample)

AgentTesla

Executable exe bd8670ff54fdb88e307e5997213a32ee95f922566923e7a645cbf120094cbbdb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd8670ff54fdb88e307e5997213a32ee95f922566923e7a645cbf120094cbbdb
  
Dropping
AgentTesla

Comments