MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da70f987b63be655f2d8bd1a1e1de03a6a09b3f2537141a196ae99edafbb1f87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da70f987b63be655f2d8bd1a1e1de03a6a09b3f2537141a196ae99edafbb1f87
SHA3-384 hash: c16bd8c1c41c5e2a3b5b5e4ec40478cef7bd309692c23ba32f86cab261c04b8fd49d509fe17ee88df5181c33a9529bc4
SHA1 hash: 140ab997af2adb4db0ae1b23dbd750e9031a8885
MD5 hash: 5c423c517996615c8116494f66a0ef91
humanhash: vegan-glucose-timing-saturn
File name:OUTSTANDING.pdf.gz
Download: download sample
File size:871'499 bytes
First seen:2020-08-12 15:52:10 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:vv1nqWB+TSVk+Z5y6VZVDykTJFzwsux7rVON60:vv1QTS1hVZhykDIVW
TLSH 0F0533D80576171F58BEF29F16B3063CA875E834EB45CE6AC1C881D81B9D0C4A7B15BE
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smarthost1.gohsphere.com
Sending IP: 173.0.139.104
From: "Barr.Klara-Marie Bartels" <Solicitors@hgc.com>
Subject: HCG Esq: Outstanding JUN,17 (URGENT)
Attachment: OUTSTANDING.pdf.gz (contains "OUTSTANDING.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.c72cdc684c432103.17239.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da70f987b63be655f2d8bd1a1e1de03a6a09b3f2537141a196ae99edafbb1f87/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 15:54:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3jyptb5whptfl4wyxunb4hpahjvatm7sknyudimwv2m63l53d6dq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
Link:
https://yomi.yoroi.company/submissions/da70f987b63be655f2d8bd1a1e1de03a6a09b3f2537141a196ae99edafbb1f87

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

gz da70f987b63be655f2d8bd1a1e1de03a6a09b3f2537141a196ae99edafbb1f87

(this sample)

Executable exe c40236c19d4369a90e61010df268f99edf0d3daeb44527d4b32af092a3765161

  
Dropping
MD5 c72cdc684c4321035d45ce963c4f31f1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c40236c19d4369a90e61010df268f99edf0d3daeb44527d4b32af092a3765161

Comments