MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4539870a922573ea9a371f5d1d0d42c3c1c7a5f331665e352a17b061f3a6f7fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4539870a922573ea9a371f5d1d0d42c3c1c7a5f331665e352a17b061f3a6f7fb
SHA3-384 hash: 49d5d0c19adfc5951d0eff923820e174011d18901d4a30febbb4c64e72a2a8e01ae59334906aa355138bcd5f39416faa
SHA1 hash: c19f29329591c979a2d33496d9aef5f1d919446a
MD5 hash: 69c5d8cdc3ac65e890d9715dae8c252f
humanhash: three-low-juliet-quebec
File name:56756753_PDF.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:498'527 bytes
First seen:2020-04-30 12:15:25 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:X7lwvAA43xx+Vyn3Y8tmNYx+LTSq2fnQK0AuB94Swhp:X7lKI3f+VyI8tDroDBOSq
TLSH 96B4237584003F8B61A93BCCDAF953BEE657C1884046E93CA646C16BCC9203B199E1FF
Reporter abuse_ch
Tags:AgentTesla ESP geo gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.ceepas.com
Sending IP: 45.95.169.72
From: Factoring y Confirming - Grupo Santander <fycuot@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 56756753_PDF.GZ (contains "56756753_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 12:37:01 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iu4yocusevz6vgrxd5or2dkcypa4pjptgftf4njkc6ygd45g675q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4539870a922573ea9a371f5d1d0d42c3c1c7a5f331665e352a17b061f3a6f7fb

(this sample)

AgentTesla

Executable exe 91a816207f5353255e7643d05b3339a42835fbb28002d7ad0a3c51330f6fe6ba

  
Dropping
MD5 d17e46feb0483db778100142df4d7cd9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91a816207f5353255e7643d05b3339a42835fbb28002d7ad0a3c51330f6fe6ba

Comments