MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e1cb52d3882e9e0fc00ee3f43c30671f2ca59866791fac3024df2c65a02147f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e1cb52d3882e9e0fc00ee3f43c30671f2ca59866791fac3024df2c65a02147f
SHA3-384 hash: 63683609fb130fb921f578a7e351ec853414e00ae225054969c806cd01ec1b5ee65617a1c63c2ef3bde92be7078f49ad
SHA1 hash: bcdd2cafae6bc1aca5ce4bd55fc5fb8d5bcb194e
MD5 hash: a82237a034e33356147b15a1d22bcdb0
humanhash: floor-ten-cola-fix
File name:swift copy.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:458'235 bytes
First seen:2020-08-19 07:30:20 UTC
Last seen:2020-08-22 21:26:39 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:gQ+RS30Mc6NHHdQTnJq900cXyK8pZdavVSl:Z/30v6ddQTJq964a8l
TLSH B5A4236E448E1ED8B9E55F7C7960503FC96832088B9DE1A8A047ED385BC2B740AD7C3D
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Merin Shibu <sales@fenicepower.com>
Received: from fenicepower.com (unknown [95.211.253.194])
Date: 19 Aug 2020 13:10:11 -0700
Subject: Re: Swift Transfer Copy
Attachment: swift copy.pdf.gz

Intelligence

File Origin
# of uploads :
44
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e1cb52d3882e9e0fc00ee3f43c30671f2ca59866791fac3024df2c65a02147f/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 07:32:08 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pyolkljyqlu6b7aa5y7uhqygohzmuwmgm6i7vqycjxzmmwqccr7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7e1cb52d3882e9e0fc00ee3f43c30671f2ca59866791fac3024df2c65a02147f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 7e1cb52d3882e9e0fc00ee3f43c30671f2ca59866791fac3024df2c65a02147f

(this sample)

AgentTesla

Executable exe 188b806e1f68912656bb5156317e03ee2927658f4879edeabb6a2bae0406f1f9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 188b806e1f68912656bb5156317e03ee2927658f4879edeabb6a2bae0406f1f9
  
Dropping
AgentTesla

Comments