MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 753858214aab243de01aa0b0acfd011c092da75c40999ff26814316b2c0c104e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 753858214aab243de01aa0b0acfd011c092da75c40999ff26814316b2c0c104e
SHA3-384 hash: 9013d0b32c25772512fa1ea1038206f82f8cd138b380ac7aa86869bfb4398a24b3c84ab901ef75586f4e56b5ae09c1a6
SHA1 hash: 60ff9d5f3dd683139a7408436d94c5923dbc9a3a
MD5 hash: 8894cdf1d912702cccbb2416f73475c7
humanhash: social-oranges-johnny-hamper
File name:COVID-19 UPDATE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:388'116 bytes
First seen:2020-03-31 18:23:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:fDjGLjxFr3ZZErygHbmJlrbE7IX6ynMzO0KSs574hlOA7L47eSnHghNIw:rujDjZcygHqJlrbKIqiCK54DZ34730f
TLSH 758423C440E366BE022DD47EE126EC492DCF8DA1C957D7A2D053A77B986C4482D3C9FA
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: mcamt.com
Sending IP: 37.49.230.105
From: "Esperanza Silvestre" <eman.almawri@mcamt.com>
Subject: Customer Advisory - COVID-19 UPDATE WORLDWILD
Attachment: COVID-19 UPDATE.zip (contains "COVID-19 UPDATE.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587 (77.88.21.158)

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.22732.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-03-31 18:35:33 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
34 of 47 (72.34%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ou4fqikkvmsd3ya2ucykz7ibdqes3j24icmz74ticqywwlamcbha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 753858214aab243de01aa0b0acfd011c092da75c40999ff26814316b2c0c104e

(this sample)

AgentTesla

Executable exe 92a19bc7fba0954919fe0aad93fd8e889631e6e335d899e2347bef09f1ceb676

  
Dropping
MD5 9893c8018ab13c7ce7ffa182753b0690
  
Dropping
SHA256 92a19bc7fba0954919fe0aad93fd8e889631e6e335d899e2347bef09f1ceb676
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92a19bc7fba0954919fe0aad93fd8e889631e6e335d899e2347bef09f1ceb676

Comments