MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e4851dc715de10390dbed4d4290bf93d496ccb68515f61d347c54e630cb2490. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e4851dc715de10390dbed4d4290bf93d496ccb68515f61d347c54e630cb2490
SHA3-384 hash: e0cec391cf10d2a1afade73be864cdbd21b947c2b86c719f009694c638a7769c45e568e96f90f4368a6e160d6ea24e16
SHA1 hash: 9ee75af53c52174445b8588fbee9ba8ff1173227
MD5 hash: 56d77ab990852b950b277ecd4704a46f
humanhash: muppet-beryllium-fifteen-quebec
File name:Drawing No 2000168004_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:8'261 bytes
First seen:2021-02-24 07:04:52 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 192:2aiA9FllGL6inOyijS5/jzxMpvJoFhk8D1dQy:fblGL6fjSVqvJoFG8RdQy
TLSH B402AFB00A7895C2CF39F92127F1D17E34A94F57EDB958F94CACD9F9C1A60046344017
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: labitconf.com
Sending IP: 103.99.1.140
From: info@labitconf.com
Reply-To: jamesadny@hotmail.com
Subject: RFQ No 2000168004 for FIRM
Attachment: Drawing No 2000168004_pdf.gz (contains "Drawing No 2000168004_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e4851dc715de10390dbed4d4290bf93d496ccb68515f61d347c54e630cb2490/
Threat name:
ByteCode-MSIL.Downloader.BaseLoader
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 07:05:36 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tzefdxdrlxqqheg35vgufef7spkjntfwquk7mhjuprkommglesia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 9e4851dc715de10390dbed4d4290bf93d496ccb68515f61d347c54e630cb2490

(this sample)

AgentTesla

Executable exe e057f177dbb47cdb739ca5300812914d10c60ef522607819b91201079ffa643d

  
Dropping
MD5 6b9d85632efc9472792a1ae89a561857
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e057f177dbb47cdb739ca5300812914d10c60ef522607819b91201079ffa643d

Comments