MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a0ba8a20e53521dee8047dc7f0742b00fdc5aef1637f2e7809886fd95d6c56d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a0ba8a20e53521dee8047dc7f0742b00fdc5aef1637f2e7809886fd95d6c56d
SHA3-384 hash: bbec1add685f9393c880d5ff5899e6faf766567b4fc1c068b1f9afc89950e61151cdbf3732c0308e393bb6ce4aff9af2
SHA1 hash: 6deb6606f489ddb8003809db5bae313b5d226dd5
MD5 hash: 7ac98ee02d4696428663d88e9a2fe105
humanhash: happy-magazine-gee-mexico
File name:CF and FDA covid-19 certificate test kits.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:361'430 bytes
First seen:2020-04-06 10:17:56 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:FRIyyjBA+RfmdDtVhE5h9Pm2oGpZ7+31zeCSclcJUtYr+Qaai4n5if1qBnv30/0C:FRIyn++YNV+31VYiQln5iNqBv3BNU
TLSH 0274235C33D48EA901384E422D68E66976C190F2E2B550F2A1DC7708FBEDE9EE127DC4
Reporter abuse_ch
Tags:AgentTesla COVID-19 gz


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: server.clinicasom.com
Sending IP: 185.76.77.225
From: WORLD HEALTH ORGANIZATION <soporte@clinicasom.com>
Subject: CF and FDA covid-19 certificate test kits
Attachment: CF and FDA covid-19 certificate test kits.gz (contains "CF and FDA covid-19 certificate test kits.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 10:36:29 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jif2riqoknjb33uai7oh6b2cwah5ywxpcy37fz4atcdp3fowyvwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4a0ba8a20e53521dee8047dc7f0742b00fdc5aef1637f2e7809886fd95d6c56d

(this sample)

AgentTesla

Executable exe 4436caf91d33d8044d493dda9265fb32c40816f2bd80ae40ac3697bb6605e2aa

  
Dropping
MD5 2a452f4163bb26a2dbeb4ffb26d6dc5c
  
Dropping
SHA256 4436caf91d33d8044d493dda9265fb32c40816f2bd80ae40ac3697bb6605e2aa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments