MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ede1b1ab28fe85b99163a84d3ab6a786e2811cfc9daae23e8a378260eec026ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ede1b1ab28fe85b99163a84d3ab6a786e2811cfc9daae23e8a378260eec026ea
SHA3-384 hash: c215dff6e3a914c7d4dc25a35447c70077035ed2ead89f6c036ad495b6e6000410765f0c1cec9a5bab67de57942b3b16
SHA1 hash: b7a2226b99e7900231bbce86d42bb89ef5f61d2b
MD5 hash: 23b603d60ca1a20af732779cdd5b7b24
humanhash: yankee-robert-item-rugby
File name:PO.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:466'231 bytes
First seen:2020-08-11 14:22:23 UTC
Last seen:2020-08-13 05:16:15 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:uAX06ghUWQSz5dw/BEMoo+zQw8u/SpDJzE8ybk4BzHJLbtggDwzbO19Ev4am3TF0:uq03nLdQw8YSI9pLpghs9weF9+bt
TLSH F5A423910BBB1284F91B18B8212FA9EDF4B0DED47175217015AEBAB1DDBE427FC32191
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Monica 媛媛@domain.invalid,monica001@lemi88.com
Subject: PO 229156.
Attachment: PO.gz (contains "PO.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ede1b1ab28fe85b99163a84d3ab6a786e2811cfc9daae23e8a378260eec026ea/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 14:24:06 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5xq3dkzi72c3teldvbgtvnvhq3richh4twvoepukg6bgb3wae3va._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ede1b1ab28fe85b99163a84d3ab6a786e2811cfc9daae23e8a378260eec026ea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ede1b1ab28fe85b99163a84d3ab6a786e2811cfc9daae23e8a378260eec026ea

(this sample)

AgentTesla

Executable exe 616ab10592901307ae43cc24dd1387523a9f4998a7cef709354f304beadfb299

  
Dropping
MD5 812d38748f4efa596c56fd4c52462a14
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 616ab10592901307ae43cc24dd1387523a9f4998a7cef709354f304beadfb299

Comments