MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc10d5d58ec3354da8a9dd2e63fb452a5af9a47bad5cfe48c1b9eb64750b70dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc10d5d58ec3354da8a9dd2e63fb452a5af9a47bad5cfe48c1b9eb64750b70dc
SHA3-384 hash: a1392ad4b5d5f3d65b1651337987726743db850d6bcfdad3d736dea0b18e71d77821cc3215f3fa68b432ff2ceebf80eb
SHA1 hash: 44d3c38cdec32b79d574a7f3817ed216b8c0d6c1
MD5 hash: aacc39df915f875e4ec5ca5d83d60b77
humanhash: tango-angel-eight-charlie
File name:BANK ORDER COPIES.XZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:418'241 bytes
First seen:2020-07-03 06:04:30 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:Q1UUanAwD6HxWI7/qahL5GPGbbh8ULPp8wEZx:iUUaA/WI7/3L4o8qB8w+x
TLSH C19423E0A9D6C0A2AF09AD3DB7CEF4827781519E2F77082A31D67D9D425CC6FE483191
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: Alice Zhoubiru <info@snaptv.me>
Subject: RE:OUTSTANDING PAYMENT//Original Scan BANK ADVICE.#47650
Attachment: BANK ORDER COPIES.XZ (contains "k1 cripted.exe")

AgentTesla SMTP exfil server:
mail.dadupipes.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc10d5d58ec3354da8a9dd2e63fb452a5af9a47bad5cfe48c1b9eb64750b70dc/
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:06:04 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7qinlvmoym2u3kfj3uxgh62ffjnptjd3vvop4sgbxhvwi5ilodoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz fc10d5d58ec3354da8a9dd2e63fb452a5af9a47bad5cfe48c1b9eb64750b70dc

(this sample)

AgentTesla

Executable exe edf16d5a8a574b768e57a54d09c4bbce2476f25bdac71439d0a6a90afea1380f

  
Dropping
MD5 3cd6b11f668877eb31d5a0245b14b51c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 edf16d5a8a574b768e57a54d09c4bbce2476f25bdac71439d0a6a90afea1380f

Comments