MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c83e710e4a935ec492905ca1bdf324036c29cefb9cadf862b5ed724c6562f6b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c83e710e4a935ec492905ca1bdf324036c29cefb9cadf862b5ed724c6562f6b1
SHA3-384 hash: 907d384d20a8efbbaef4a500bd73fc54cd59f4b41b2c364cabdb99e145d7008e29fdb363f73b95f25e9699e9ea95c2cf
SHA1 hash: fa056d17f41602ab7b7f5bce1a04ec5fab9c1498
MD5 hash: 5ff7588205c98314824330ad4d9fae28
humanhash: skylark-music-tennessee-chicken
File name:DRW_0084667.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'837 bytes
First seen:2020-05-25 11:46:24 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:qYZIhak+eQerJ+94kUZ239Yd/CuG8k0kOHBpRp1qXWCVwGlTl6VffRjbOhQLjY3Y:qAIhLc023aguG8Hkkp1mwDpRvOhvrERR
TLSH 3B8423BEE990B1236D18EA903A43A4C164E43B294128D76DB7DD7312C3A27035ED979F
Reporter abuse_ch
Tags:AgentTesla gz HostGator


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway20.websitewelcome.com
Sending IP: 192.185.55.25
From: Rani Tarabey <rani.tarabey@khambatigroup.tv>
Subject: Inspection Equipment - Request for Sales Quotation
Attachment: DRW_0084667.gz (contains "DRW_0084667.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 12:05:21 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
10 of 47 (21.28%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz c83e710e4a935ec492905ca1bdf324036c29cefb9cadf862b5ed724c6562f6b1

(this sample)

AgentTesla

Executable exe 2370632e89b7760a6fb52b85bc77178c4511e62804a2b2d34c24e4a1303a9a25

  
Dropping
MD5 832ecb7c3db9d5c2cae0751819a883db
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2370632e89b7760a6fb52b85bc77178c4511e62804a2b2d34c24e4a1303a9a25

Comments