MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f8719454a5d66f66217862dfa00f945e23fa900ebbb2a15020e95d1456d9e8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


404Keylogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f8719454a5d66f66217862dfa00f945e23fa900ebbb2a15020e95d1456d9e8f
SHA3-384 hash: 5055340591d2806f7010144b085ea7840ce3ae48d0daf456c09ab7cb0ef16e19e3dbf1e23ae61f0c9f3730c67d37059b
SHA1 hash: b96331803fb42f5732d1c3dd5961f2dd24960334
MD5 hash: a9a5156e6c02ef71536fa26d7a19883d
humanhash: beer-neptune-bulldog-kilo
File name:Orden010221.zip
Download: download sample
Signature 404Keylogger
Create hunting rule
File size:423'011 bytes
First seen:2021-02-02 07:32:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:hHxV+CnbBGYyu3b31ncqvR3hTfwzka3ztI0jV2fo+8RoG7tswzLrQqGm+69jU:bkCnw63b3BhTfKztIffrG7qcvDhjU
TLSH A2942369D075486FA25F3F3BBCA9E45109ADE4501AB02E9F1BC418EBC3C9DA9101BF1C
Reporter abuse_ch
Tags:DHL ESP geo zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: corsersac.com
Sending IP: 45.153.242.195
From: Javier Exebio <jexebio@corsersac.com>
Subject: Fwd: Actualización planos DHL
Attachment: Orden010221.zip (contains "orden010221.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f8719454a5d66f66217862dfa00f945e23fa900ebbb2a15020e95d1456d9e8f/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 07:33:06 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6drsrkklvtpmyqxqyw7uahzixrd7kia5o5suficb2k5crlnt2hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f8719454a5d66f66217862dfa00f945e23fa900ebbb2a15020e95d1456d9e8f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

404Keylogger

zip 4f8719454a5d66f66217862dfa00f945e23fa900ebbb2a15020e95d1456d9e8f

(this sample)

404Keylogger

Executable exe 2348ad3a4247f29ff40fbbdcbf559dedf6396e2fda0a1a9693d48fa0f0bc14b7

  
Dropping
MD5 d35463b27bc9d531685c21d6b25bcb23
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2348ad3a4247f29ff40fbbdcbf559dedf6396e2fda0a1a9693d48fa0f0bc14b7

Comments