MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94c4df62251c6aa480181cd98e67e893e67747c6b27a2bda15993559edf5fbe1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94c4df62251c6aa480181cd98e67e893e67747c6b27a2bda15993559edf5fbe1
SHA3-384 hash: b35ff795f6c9fa5fec473cdd7faee42ab2fe42535cb2d5d9e715318de9bd1f4b534fab09782cdefdbd92cca1b524b223
SHA1 hash: 04f83c1f94546d38e9b47d2c701d54c6ed7d9ae0
MD5 hash: 72ffc6e8a456b9575e7d61dfe7ac0e3e
humanhash: bravo-south-cold-twelve
File name:634767.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'284 bytes
First seen:2020-05-04 21:16:06 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:EeW5hioCgpqV/03SqdLzLnWzG1PmP0hDTWYIlYqBeE:EfCgpCDqdLfWzG1PA0h+YAYqBeE
TLSH D09423BB508DFD8B0AD0AB7E4004CC3331EAEA4ABF5680E69B5D89ED94F06830D51D49
Reporter abuse_ch
Tags:AgentTesla ESP geo gz Santander


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: linux10c.empresawww.com
Sending IP: 149.202.168.192
From: Factoring y Confirming - Grupo Santander <fycout@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 634767.gz (contains "634767.exe")

AgentTesla SMTP exfil server:
smtp.mail.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 21:36:56 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=stcn6yrfdrvkjaaydtmy4z7ispthor6gwj5cxwqvte2vt3pv7pqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 94c4df62251c6aa480181cd98e67e893e67747c6b27a2bda15993559edf5fbe1

(this sample)

AgentTesla

Executable exe 895225b53f54d122a60d52a692acfe09a4fb64fbc2bea01746d2ec3f12e3a564

  
Dropping
MD5 91491181ae63cac28abe4f0059c9fe29
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 895225b53f54d122a60d52a692acfe09a4fb64fbc2bea01746d2ec3f12e3a564

Comments