MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1942758015f2ed95a6aa041f19cfbf2fa25aebdd4598b23beba2420d3aeebf88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1942758015f2ed95a6aa041f19cfbf2fa25aebdd4598b23beba2420d3aeebf88
SHA3-384 hash: f8df21fcbc7be697ec2553f99c749e2c7795a2c6ed48b800a78ca06f89ce0ff8b1f68ba984442a2dc2e88364a1fdbebd
SHA1 hash: b213f816fffc07974e832a7e6483890932062d64
MD5 hash: 01bff21d48af2ab21d2074c3b71120d8
humanhash: delaware-fruit-nevada-uncle
File name:SolutionFighting_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'500 bytes
First seen:2020-03-27 14:02:30 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:8jJGuWQeZljTfoIs24ft+QxL/SSooR2IgerjKVfdT+fqIvKKOi1gXQUi8w91ze:8QuaZl/B9qQQpkTIge/KV5+ydKOTbl
TLSH 98942346F5FF0040589173125239FF867B9AC1BC10799B7CA239C08E1AA7EC727563AB
Reporter abuse_ch
Tags:AgentTesla COVID-19 gz


Avatar
abuse_ch
COVID-19 malspam campaign distributing AgentTesla:

HELO: staging.maykenbel.com
Sending IP: 195.12.49.182
From: Johnny Meng <thanh@oriontex.com.cn>
Subject: SOLUTION FIGHTING COVID-19
Attachment: SolutionFighting_pdf.gz (contains SolutionFighting_pdf))

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.45719.28801.12290.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-03-27 12:50:34 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
29 of 47 (61.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dfbhlaav6lwzljvkaqprtt57f6rfv265iwmleo7lujba2oxox6ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 1942758015f2ed95a6aa041f19cfbf2fa25aebdd4598b23beba2420d3aeebf88

(this sample)

AgentTesla

Executable exe 17bbea6ca05282ea03942ee0ace1d10acaa2fe617623e552e650079bf6586d11

  
Dropping
MD5 77bf9d18cb7430fb91f024a14b198a6c
  
Dropping
SHA256 17bbea6ca05282ea03942ee0ace1d10acaa2fe617623e552e650079bf6586d11
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 17bbea6ca05282ea03942ee0ace1d10acaa2fe617623e552e650079bf6586d11

Comments