MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10c4cc5a72f4a8a473869fa205c94c0a2928f2fb5d75c9d14e975f6b4dacedad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10c4cc5a72f4a8a473869fa205c94c0a2928f2fb5d75c9d14e975f6b4dacedad
SHA3-384 hash: 4cf3ed51078367fa124e203b55052c8960e03de8907b1bc9e3a4123499b962cea257c73e9b2e391ac3b53552221dfa8e
SHA1 hash: 1e7c58661f22932793d546c6f12cd844e2c54216
MD5 hash: ba89345b52ae51021ff10539deabdfbc
humanhash: six-fanta-east-four
File name:SKM_36720061516300.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:883'200 bytes
First seen:2020-08-05 08:00:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:bg3Vc1a/unFJKy03uAf1zBVAwvuZM0uHdoM31+xcO1auTBdRFwmYH9xpobnZP:UC8uFH7AfT0MVHdd30xky7FXYHfpux
TLSH A01533D9EA1F90958B627E9CCE18E4C8B7D4E1512DAEBD5C06341CBE840FFDBE201285
Reporter abuse_ch
Tags:AgentTesla Hostwinds zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-752042.hostwindsdns.com
Sending IP: 104.168.159.72
From: MURAT ERTUG <info@emeanark.com>
Subject: PURCHASE ORDER
Attachment: SKM_36720061516300.zip (contains "3bYua7s8vN9yzI8.exe")

AgentTesla SMTP exfil server:
mail.aoki-shoten.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Maria.4.20131.26675.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10c4cc5a72f4a8a473869fa205c94c0a2928f2fb5d75c9d14e975f6b4dacedad/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:02:12 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cdcmywts6suki44gt6ralskmbiusr4x3lv24tukos5pwwtnm5wwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10c4cc5a72f4a8a473869fa205c94c0a2928f2fb5d75c9d14e975f6b4dacedad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 10c4cc5a72f4a8a473869fa205c94c0a2928f2fb5d75c9d14e975f6b4dacedad

(this sample)

AgentTesla

Executable exe 38eb441454dd6b9459981660281d748fc8d5052a07b15597d317a3fec3b72400

  
Dropping
MD5 604e8db8c4e26fd30e95c6e0785be630
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38eb441454dd6b9459981660281d748fc8d5052a07b15597d317a3fec3b72400

Comments