MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58c3e15911b23e6a99e13616ceb07b43c682887d0b463806a44f789c8119e4fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58c3e15911b23e6a99e13616ceb07b43c682887d0b463806a44f789c8119e4fe
SHA3-384 hash: 5fc065e63b7f8e9fe07ac01d3ef18c44be7d51461826d46ce5675bd4fe471c01aea22e716eefba51d434f03c8faa111d
SHA1 hash: cfe736219d670d1dae1764fa1c5d433dd8253300
MD5 hash: 796bb2c2fb582f0a0893313475df50be
humanhash: steak-california-seven-mississippi
File name:Products_Pictures_logo_Designs_ pdf.zip
Download: download sample
Signature HawkEye
Create hunting rule
File size:81'962 bytes
First seen:2020-10-10 06:59:59 UTC
Last seen:2020-10-10 07:01:36 UTC
File type: zip
MIME type:application/zip
ssdeep 1536:uPeJP0LLNSmJyknxHzeZ0wIFgj8pXA5hxkR82h+L3SZdpQXPN:yqmUmJ7eZ01Fguyhxk2zyUX1
TLSH A08302E8D29E62D54D8091FAF763BCB4BE38A6FF8590B94D44A4A64CF1A1D3C0C32547
Reporter abuse_ch
Tags:HawkEye zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gvg-redsun.com
Sending IP: 58.213.91.113
From: Johnason_Chen <ccp@chinaredsun.com>
Subject: ATTACHED FILE PRODUCTS NEEDED PLEASE
Attachment: Products_Pictures_logo_Designs_ pdf.zip (contains "Pictures_logo jpeg jpeg jpeg.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58c3e15911b23e6a99e13616ceb07b43c682887d0b463806a44f789c8119e4fe/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-10 01:42:13 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ldb6cwirwi7gvgpbgylm5md3ipdifcd5bnddqbvej54jzaiz4t7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58c3e15911b23e6a99e13616ceb07b43c682887d0b463806a44f789c8119e4fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 58c3e15911b23e6a99e13616ceb07b43c682887d0b463806a44f789c8119e4fe

(this sample)

AgentTesla

Executable exe 8d706befed861457d7fcf22d6c23b5b66c0ad7fec59552410f07b34723924fed

  
Dropping
MD5 d9810179fbdb411ff17436205cbcc58b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d706befed861457d7fcf22d6c23b5b66c0ad7fec59552410f07b34723924fed
  
Dropping
SHA256 42ab5d79e6f8efc09363309f90fa36a4b07a2b945ff8976e922b7aa75ec243d8
  
Dropping
MD5 db4526653077e8a2a5509de72d1edf80
  
Dropping
SHA256 3822d27d679a8a6ed258783c32000566819f58779cdb911c36e122fe902950f2
  
Dropping
MD5 b934fc6cc0c384172bebd09853d20bb5

Comments