MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba570e6acfa7218b11d2e29c0a066d6166be412258608fbaa3fb29aa3fe1fdce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba570e6acfa7218b11d2e29c0a066d6166be412258608fbaa3fb29aa3fe1fdce
SHA3-384 hash: 02af089e24137132f5a2ef5e62aff02db5d8a73ef5a423fb237e12b18ce18061ab3e0b2ddb14a30da886f9d8252737b2
SHA1 hash: dade265d5a3ba8ef16570979e2ad4590672f5fb6
MD5 hash: 5c80dff22c58558e391b15ceaf14d3ca
humanhash: football-rugby-queen-early
File name:Scan documents 9930388.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:768'687 bytes
First seen:2020-11-24 06:31:04 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:8+PDkgSUPg8etEjVtgLpuwE3rR1CfmUYkw+M8CFrsDqLQ24CNd4rVD6EKYiiEcSH:8+PD1g8QgbgLst1Cf3M+MJsDcd4R6EoT
TLSH 35F433516ABC45B057CA3894803D4D6C19368FCE5BBA3B47AC0FEB29B0CDC4E9156A37
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: ""Kanchana Shetty" <dha@technogroupllc.comy>" (likely spoofed)
Received: "from system.clearos.lan (unknown [203.160.175.124]) "
Date: "Tue, 24 Nov 2020 00:14:16 +0100"
Subject: "Purchase Order"
Attachment: "Scan documents 9930388.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba570e6acfa7218b11d2e29c0a066d6166be412258608fbaa3fb29aa3fe1fdce/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-24 06:32:07 UTC
File Type:
Binary (Archive)
Extracted files:
31
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjlq42wpu4qyweos4koaubtnmftl4qjclbqi7ovd7mu2up7b7xha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ba570e6acfa7218b11d2e29c0a066d6166be412258608fbaa3fb29aa3fe1fdce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ba570e6acfa7218b11d2e29c0a066d6166be412258608fbaa3fb29aa3fe1fdce

(this sample)

AgentTesla

Executable exe 0f20eb4400b00c0698e5f24ca1541203eab68f6104aa15e8002bf845b0326076

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f20eb4400b00c0698e5f24ca1541203eab68f6104aa15e8002bf845b0326076
  
Dropping
AgentTesla

Comments