MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b63c9ff865026ae7be588644a648bd8de9e9a93a1436ad18a102cd3eedfc855. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b63c9ff865026ae7be588644a648bd8de9e9a93a1436ad18a102cd3eedfc855
SHA3-384 hash: 7e452352e2439e9d3f377748954622b49331abfbc2daab85752e8bf85eaf3933ce497fac87115f8924ba6d2d933f8bee
SHA1 hash: 9eff2ede5f29d4fd4c0d9c8ae512e4fac845aabd
MD5 hash: eaf70c92a843d741f7cfb0145259ef4a
humanhash: equal-avocado-bacon-sixteen
File name:Contact Form.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:636'665 bytes
First seen:2020-08-19 11:13:00 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:MySc0n8hbpCy4sXM5xxpQGNe+42wNH8OISm4UY0yf:Mrc0CkNZj42uJISyYH
TLSH 8AD4232D7E43FA7F4DB55FBCED884BA48935AE8CD84A111A59DF7F170C4012926C0AAC
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.spiact.ro
Sending IP: 81.18.71.206
From: DHL notification <lucian.grigore@rd-enginery.ro>
Subject: DHL Notification
Attachment: Contact Form.pdf.gz (contains "Contact Form.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b63c9ff865026ae7be588644a648bd8de9e9a93a1436ad18a102cd3eedfc855/
Threat name:
ByteCode-MSIL.Trojan.Perseus
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 11:14:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnr4t74gkatk467frbseuzel3dpj5gutufbwvumkcawnh3w7zbkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b63c9ff865026ae7be588644a648bd8de9e9a93a1436ad18a102cd3eedfc855

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4b63c9ff865026ae7be588644a648bd8de9e9a93a1436ad18a102cd3eedfc855

(this sample)

AgentTesla

Executable exe fc87f06a5699c35bd0fd808b51c0b0558f112e5bb0158d7553a07456d3cd4ffc

  
Dropping
MD5 484b2e072d0ef7903af8c0098b2169a3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc87f06a5699c35bd0fd808b51c0b0558f112e5bb0158d7553a07456d3cd4ffc

Comments