MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 408bde2024c8b5840b9301dd0537f67a4aa269c35acd603fa04c8875cea88cc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 408bde2024c8b5840b9301dd0537f67a4aa269c35acd603fa04c8875cea88cc1
SHA3-384 hash: 904319f90889e1dc54339dd56e4718bef7e69fc32fcfb408ef6459a1318a14b8a6a2b3e1ac25c8259c078d70850b9ffe
SHA1 hash: ee640bd0c28c15534539abc9652cacbea4750ebe
MD5 hash: 7135da289d6ab6ec8d490b6439fb6f3c
humanhash: uranus-wyoming-mike-edward
File name:Invoices.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:28'003 bytes
First seen:2020-03-20 11:04:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:A8ffTmQzDehMFtT1T7WF0l2ZC2wKpyJbUV/A91oIYBpXNaEkr/l4Kkv0VktgFpAP:LSfCbT7WaBGA8ppXNaEkJ7vCtgD8n0g/
TLSH 42C2E1AFA7A1240DF1B8376C6D217C53174C2BEEA1767E2E6D083EAA42406504FDBC47
Reporter abuse_ch
Tags:AgentTesla COVID-19 exe GuLoader


Avatar
abuse_ch
COVID-19 themed malspam, distributing GuLoader -> AgenTesla

HELO: bcsl.co.ke
Sending IP: 103.99.1.158
From: Marketing <info@bcsl.co.ke>
Subject: RE: Due to outbreak ofCoronavirus
Attachment: Invoices.rar (invoices.exe)

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-20 22:06:24 UTC
AV detection:
26 of 45 (57.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=icf54ibezc2yic4tahoqkn7wpjfke2odllgwap5ajsehltvirtaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/408bde2024c8b5840b9301dd0537f67a4aa269c35acd603fa04c8875cea88cc1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 408bde2024c8b5840b9301dd0537f67a4aa269c35acd603fa04c8875cea88cc1

(this sample)

AgentTesla

Executable exe 844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146

  
Dropping
MD5 4fdec4cf21511060ac0dca9fba5637c2
  
Dropping
SHA256 844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146
  
Dropping
SHA256 844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146
  
Dropping
SHA256 844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146

Comments