MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10c8830913f96d811fed0d3318412fb966b9e938c805a67a356aa210cfbecf21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10c8830913f96d811fed0d3318412fb966b9e938c805a67a356aa210cfbecf21
SHA3-384 hash: de95093df7c470587bbc09d4c1b7e10f8ad5202923ec26a0cd0851ff56f29183967891e0a49fa07eedd6b571f4ceac26
SHA1 hash: 616f787bc208b134560645af5eb48408f3df9b93
MD5 hash: 30e71d958acd912a0f70c67e65d05dfc
humanhash: glucose-alaska-carbon-king
File name:PROFORMA INVOICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:570'233 bytes
First seen:2020-09-02 06:09:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:5RbH+/lyNMb4hE3kNzlDvVgH3K9utlPpQtcr8zdogyeFAs6R:3T+4NsRcRLVgH3KkjrmAH
TLSH 83C42346BC3D1BF19B2E95A10E33A3D27F1C152A974323495AE5E4C0BC087726AF9C76
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: outbound-gw.openxchange.ahost.me
Sending IP: 94.136.40.163
From: danny@gms.scot
Reply-To: danny@gms.scot
Subject: PROFORMA INVOICE
Attachment: PROFORMA INVOICE.zip (contains "PROFORMA INVOICE.exe")

AgentTesla SMTP exfil server:
smtp.dedhivala.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10c8830913f96d811fed0d3318412fb966b9e938c805a67a356aa210cfbecf21/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 05:40:47 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cdeigcit7fwych7nbuzrqqjpxftlt2jyzac2m6rvnkrbbt56z4qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/10c8830913f96d811fed0d3318412fb966b9e938c805a67a356aa210cfbecf21

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 10c8830913f96d811fed0d3318412fb966b9e938c805a67a356aa210cfbecf21

(this sample)

AgentTesla

Executable exe 048674629add2dc37cc99ab62fef41b4198e89807627b23652916bcec41476c8

  
Dropping
MD5 3d5ca50a71be7fba2de60785548114ff
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 048674629add2dc37cc99ab62fef41b4198e89807627b23652916bcec41476c8

Comments