MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52744e946b514aa69193d3c3ae08e62b745df0a599d37b61852c6db88d2ac057. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52744e946b514aa69193d3c3ae08e62b745df0a599d37b61852c6db88d2ac057
SHA3-384 hash: 831d6135277a07f3a5981486821215c4c94788be78e7534d285ca3d2b25dd5b67485df522f43ed721589f5e8a9c7634c
SHA1 hash: 0803e8b9119d2e42f61e6cf91c0427db753b5701
MD5 hash: 8bd2409d463a34ae7e8c635448598db3
humanhash: colorado-lima-connecticut-four
File name:Notificación de depósito a su cuenta.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'514'234 bytes
First seen:2020-04-14 17:43:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:7I2GT4/oB4YC/7xJF5+BDXZPcYuLV3Fm6khwpK5/zPD505rwYvAng49gVS:7+M/P/7/KBDpu9kGo5zPD50BwGug3VS
TLSH 0265336EE33AF006014BFB13F1A41456A77B4842A1ADAED5E0647DF863F417D0F86D8A
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesal:

HELO: foe.com
Sending IP: 173.82.155.122
From: GAIL <admin@gailimited.com>
Subject: FONDOS DE ALIVIO DE COVID-19
Attachment: Notificación de depósito a su cuenta.zip (contains "Notificación de depósito a su cuenta.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.Generic.vh.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Aitinject
Create hunting rule
Status:
Malicious
First seen:
2020-04-14 18:35:36 UTC
AV detection:
26 of 45 (57.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kj2e5fdlkffknemt2pb24chgfn2f34ffthjxwymffrw3rdjkyblq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 52744e946b514aa69193d3c3ae08e62b745df0a599d37b61852c6db88d2ac057

(this sample)

AgentTesla

Executable exe 45c5cce52794a537e01a7f2262dd8b5a27953e58f81e849afb7b59bac82e760f

  
Dropping
MD5 20578fb9870bb357bd3cfe339accfe16
  
Dropping
SHA256 45c5cce52794a537e01a7f2262dd8b5a27953e58f81e849afb7b59bac82e760f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 45c5cce52794a537e01a7f2262dd8b5a27953e58f81e849afb7b59bac82e760f

Comments