MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cff19a3edb8732de0c65cf3e06f56a5cf20ad6e6144bd1aaeff441c549f437a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cff19a3edb8732de0c65cf3e06f56a5cf20ad6e6144bd1aaeff441c549f437a
SHA3-384 hash: f4f75f4335622026065671275d9aeec5b84200c3e16d3f2b50cfaf5017997b95261a7eb00d4c44bcf64c6f2865b3333f
SHA1 hash: 4894f6e2558ccd1d33bfbb44972505898c434ead
MD5 hash: 0cee63e97f65e93df72183d46403ce5c
humanhash: batman-william-pennsylvania-xray
File name:NEW ORDER INQUIRY-002692020.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'115 bytes
First seen:2020-06-09 05:41:07 UTC
Last seen:2020-06-09 07:47:36 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:WyDXHiBgc5lE7oEbfDyVpiF96jbrZTkWTGjusm6j3QLr1ew+ZGY7uKQF9uxc9lak:77iBblgoE7XGbzSjucIMwEv5QF912I
TLSH 869423DF136E62EE693AC61817E92877F1432DB5FA8EF5A6DCA5C214809700F48478CD
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Ms. Ashley Sun <sales@shenghai-alu.com>
Received: from shenghai-alu.com (unknown [78.129.132.154])
Date: 9 Jun 2020 04:49:50 +0100
Subject: NEW ORDER INQUIRY-002692020
Attachment: NEW ORDER INQUIRY-002692020.pdf.gz

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 03:18:47 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lt7rti7nxbzs3yggltz6a32wuxhsbllomfcl2gvo75cbyve7in5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5cff19a3edb8732de0c65cf3e06f56a5cf20ad6e6144bd1aaeff441c549f437a

(this sample)

AgentTesla

Executable exe 7dee2ef297b0f8a08d2b445aa7dc561833357e20e3cdc6fd8fbd37519af8fcb6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7dee2ef297b0f8a08d2b445aa7dc561833357e20e3cdc6fd8fbd37519af8fcb6
  
Dropping
AgentTesla

Comments