MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b37415a11380e74706dbe738b224b765f8465bdfac27ae70102357a57c870ca5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b37415a11380e74706dbe738b224b765f8465bdfac27ae70102357a57c870ca5
SHA3-384 hash: c86a4aa4494fdb4b65ce09174703f579cec55f4dabe6c5d1cc09dcc4bc1b288e80fea54759e88c438ae2aaccba822c60
SHA1 hash: f7d8c2743f45bc3652eda10074ef6d58216e86c4
MD5 hash: 40df62708412f7436e5cbe26e10886e9
humanhash: equal-fish-kansas-moon
File name:Scan_Document.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:568'483 bytes
First seen:2020-10-15 10:55:40 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:KXsy7CECOJHBoBUdHCfDcbcnxoNq0qfKOTH1n6dDE+tEWXam5YjHyRFFjHL4:fy7tCSuz44WNqJKOTHFODE+mIag0Hn
TLSH 72C423B5605CA3A949EFF3BC88D4038EAF03974D8334696C5886D681D53107E7B8FA76
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: leitner.co.uk
Sending IP: 172.82.128.241
From: DFC Purchasing<sales@leitner.co.uk>
Subject: Purchase Order
Attachment: Scan_Document.gz (contains "Scan_Document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25902.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b37415a11380e74706dbe738b224b765f8465bdfac27ae70102357a57c870ca5/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 21:03:56 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wn2bliitqdtuobw3444lejfxmx4emw67vqt244aqenl2k7ehbssq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b37415a11380e74706dbe738b224b765f8465bdfac27ae70102357a57c870ca5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz b37415a11380e74706dbe738b224b765f8465bdfac27ae70102357a57c870ca5

(this sample)

AgentTesla

Executable exe 0bca9ab193fb9d806d0fb74f5d03ef6f454037d5fe784a8b8fb912ccfc790719

  
Dropping
MD5 8fdf8d891d20326e91c0d4569a17154b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0bca9ab193fb9d806d0fb74f5d03ef6f454037d5fe784a8b8fb912ccfc790719

Comments