MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53b31105cbd5703beb0bb4534801931b54f3c8fddc4c1f3807abe61965c95e53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53b31105cbd5703beb0bb4534801931b54f3c8fddc4c1f3807abe61965c95e53
SHA3-384 hash: 51fc508ef11479124ea3a9670a41881c95546f5117872abf187b51ef7e276780aec714281cc45d64679a5fd5defb29e8
SHA1 hash: a2ad72bfd37c4ee503b13ba1c316eae034d3bab3
MD5 hash: c7b6d1aa7308142d98d2b159eb3698b6
humanhash: october-single-charlie-west
File name:Sample Product.r09
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'309'912 bytes
First seen:2020-04-07 07:10:43 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 24576:hcbZXycXVQzGdCDi9KrY/1f92VbYElBzVss5dQr7CxJu0ZT5JtbL/eOsczQUDC6:haT6GdCid/1f4VLe4U7Cru0t5JtXGOtT
TLSH 025533A6E7296DF5AF600FB432216970563F068D000F9C576A6BF70B6C0866FC61E06F
Reporter abuse_ch
Tags:AgentTesla COVID-19 rar


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: secure.imhostings.com
Sending IP: 23.235.211.82
From: Ghaith Alnadi <rohan.jayawardena@multywaychem.com>
Subject: COVID-19 Supplies (Masks, Gloves, & other products)
Attachment: Sample Product.r09 (contains "Sample Product.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-07 07:36:29 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
22 of 47 (46.81%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kozrcbol2vydx2ylwrjuqamtdnkphsh53rgb6oahvptbszojlzjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 53b31105cbd5703beb0bb4534801931b54f3c8fddc4c1f3807abe61965c95e53

(this sample)

AgentTesla

Executable exe 00f313a02b466a8482a613b1c44ed1d119fb467ea01bc93a9192ab3c48d661e5

  
Dropping
MD5 2f35acda03e3f95e72d41063ad9c490f
  
Dropping
SHA256 00f313a02b466a8482a613b1c44ed1d119fb467ea01bc93a9192ab3c48d661e5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 00f313a02b466a8482a613b1c44ed1d119fb467ea01bc93a9192ab3c48d661e5

Comments