MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10e83c4eaa3a9a77b436a9ac2e42d0be0bb5e31da719d5654ce556b15b0d8beb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10e83c4eaa3a9a77b436a9ac2e42d0be0bb5e31da719d5654ce556b15b0d8beb
SHA3-384 hash: 0060cbc06a8de3d9940b462630b3fb2f604f2990972d41bc9a2648fb83176338b02c3760312a1101c214513b265a45ef
SHA1 hash: 7cb80a08dbe9f81f49306b933a75f8990fc0f0a7
MD5 hash: afbbcd22e35ce1be8117f4cd5ff3472f
humanhash: winter-maryland-foxtrot-leopard
File name:2343234323432.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'656 bytes
First seen:2020-05-01 12:24:42 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:BM4STe+mJButVMwW/L4WUWOOTm2w2KhjhlU0fGYWYIxjhKpSF74z7d+TuDKegx6H:ajtVMDTlUWLmV2WTJ15EE9niuDKL63NN
TLSH 0494233A650CFC8D3DA02EC9EB4172C00A5B7B860524A0B36F517538EFDDB951BC9A39
Reporter abuse_ch
Tags:AgentTesla ESP geo gz Santander


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.qrodi.com
Sending IP: 45.95.168.60
From: Factoring y Confirming - Grupo Santander <fycuot@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 2343234323432.gz (contains "2343234323432.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
297
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43067833.24015.17961.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 20:12:52 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cdudytvkhknhpnbwvgwc4qwqxyf3lyy5u4m5kzkm4vllcwynrpvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 10e83c4eaa3a9a77b436a9ac2e42d0be0bb5e31da719d5654ce556b15b0d8beb

(this sample)

AgentTesla

Executable exe 85c4ef5d2557b3ee860576a0d9bae8610ae5995a115c8a2f07d02c8c82b6c2c0

  
Dropping
MD5 9b7d7fc9f2cb778a9896c33048bd8fed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85c4ef5d2557b3ee860576a0d9bae8610ae5995a115c8a2f07d02c8c82b6c2c0

Comments