MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49e5d63b87b7ed850fe7efe20bc291354464e9e7e0d47df1a7a7238d525b7938. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49e5d63b87b7ed850fe7efe20bc291354464e9e7e0d47df1a7a7238d525b7938
SHA3-384 hash: ce24a5706f2980654cd378f269fa19c0a2e9c1d9ea5798686aaaf2b9e9fe0f774d47c2f4ebc452487fb4e38ebc4dffa8
SHA1 hash: c22fc7eab07ca1f78ee3943ebe2eee7ae82459e8
MD5 hash: 76eef942bdc7d0191a14d89121f292f7
humanhash: bluebird-mexico-music-undress
File name:shipping documents.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:795'521 bytes
First seen:2021-03-29 05:34:07 UTC
Last seen:2021-03-29 10:03:26 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:TVN5QGeqYkR76hRFukDMCYfq/lvY5vq3HQAtUPAZ:b+NqGukKfq/lvY5vqAl0
TLSH 810533877C63039C4ED2F8273310EC8638BD99618C5EC5EDBAE4C743A6579079A84E87
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Patrick Tan <patrick@hydrodynamic.com.sg>" (likely spoofed)
Received: "from hydrodynamic.com.sg (unknown [66.154.97.99]) "
Date: "29 Mar 2021 01:16:24 +0200"
Subject: "SHIPPING DOCUMENTS"
Attachment: "shipping documents.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis52516DB41B1B.7171.19021.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/49e5d63b87b7ed850fe7efe20bc291354464e9e7e0d47df1a7a7238d525b7938
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49e5d63b87b7ed850fe7efe20bc291354464e9e7e0d47df1a7a7238d525b7938/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-03-28 22:32:53 UTC
File Type:
Binary (Archive)
Extracted files:
32
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhs5mo4hw7wykd7h57raxqurgvcgj2ph4dkh34nhu4ry2us3pe4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/49e5d63b87b7ed850fe7efe20bc291354464e9e7e0d47df1a7a7238d525b7938

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 49e5d63b87b7ed850fe7efe20bc291354464e9e7e0d47df1a7a7238d525b7938

(this sample)

AgentTesla

Executable exe 0f22a0c19896549b7d1f6fdcfc677392d1950190bfeaaa1ad00e291c7ee65e97

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f22a0c19896549b7d1f6fdcfc677392d1950190bfeaaa1ad00e291c7ee65e97
  
Dropping
AgentTesla

Comments