MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad85454640493c60adffa04d6b443b1292d0c8a9a8d82418f3c706f3161ea21f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad85454640493c60adffa04d6b443b1292d0c8a9a8d82418f3c706f3161ea21f
SHA3-384 hash: 51dc6f4ea6d18380a0d7d982539a04065615f0bbeecbbff5400ea58db3fd33f0c49133360087b72355b58167b27c685a
SHA1 hash: 4c222799507984efee0142381cb5cf339b4e01b5
MD5 hash: 4cf6bc5d314d913de7ef2cc474822c75
humanhash: low-river-kansas-lactose
File name:Outstanding Details.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:542'395 bytes
First seen:2020-08-18 06:25:17 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:R221Oq+lF0dwOSjfq41Q5Tf9Jh/3VbCsyEnNSfF3sgj7y:R221+lFVjXyz33VnNO8gj7y
TLSH E9B42313A5977AE1D6C404A736F664FDC31EF400B9BE641D020C9ABF24929BF10DA827
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smarthost1.gohsphere.com
Sending IP: 173.0.139.104
From: Barr.Klara-Marie Bartels <Solicitors@hgc.com>
Subject: HCG Esq: Outstanding JUN,17 (URGENT)
Attachment: Outstanding Details.pdf.gz (contains "Outstanding Details.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad85454640493c60adffa04d6b443b1292d0c8a9a8d82418f3c706f3161ea21f/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 06:27:06 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vwcukrsaje6gblp7ubgwwrb3ckjnbsfjvdmcighty4dpgfq6uipq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ad85454640493c60adffa04d6b443b1292d0c8a9a8d82418f3c706f3161ea21f

(this sample)

AgentTesla

Executable exe 2465612670a2a23f8139439948328b37c74cfa62cecc138de0ed06641e99ff7d

  
Dropping
MD5 3051ba786f6ef9109bd994a5d8c2e403
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2465612670a2a23f8139439948328b37c74cfa62cecc138de0ed06641e99ff7d

Comments