MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b71014a5535da55491b73d2d1dbab76d822e4bf887cf1a743a4c37b35fe50c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b71014a5535da55491b73d2d1dbab76d822e4bf887cf1a743a4c37b35fe50c2
SHA3-384 hash: d34c9c5c487ff94e3f6c881b983185f1d9fc00ebca9284fa149cd64b749d2ed7dd09da503855942ac80cf1a2ebe323e8
SHA1 hash: 52022c7a2b4e8ca7739d74fdee54efd9e994476e
MD5 hash: 325611765682f0766811604485be2945
humanhash: pennsylvania-ceiling-alaska-apart
File name:COVID-19_040220.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:25'119 bytes
First seen:2020-04-02 15:33:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:JBwCeYm6CnGHcXGAhSP1Jcwozph9no7Mil:JuGUGA4P1Kwozph9noL
TLSH 6EB2E1E72D96A5CC79A4C08FE424100B10BE2B7FAE51272E6C2A8DD9E0777D25F11538
Reporter abuse_ch
Tags:AgentTesla COVID-19 GuLoader rar


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader->AgentTesla:

HELO: ns392991.ip-176-31-110.eu
Sending IP: 176.31.110.7
From: Dr. Kim Jung <info@hardworkingincs.pro>
Subject: Latest vaccine release for Corona-virus(COVID-19)
Attachment: COVID-19_040220.rar (contains "COVID-19_040220.exe")

GuLoader payload URL (AgentTesla):
https://drive.google.com/uc?export=download&id=1CLCbjFy3aoGBl07CLV-M4GdEGw7Io-ns

AgentTesla SMTP exfil server:
mail.asesoriaurquijo.net:587 (31.193.225.102)

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Minix
Create hunting rule
Status:
Malicious
First seen:
2020-04-02 15:35:21 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pnyqcssvgxnfksi3opjndw5lo3mcfzf7rb6pdj2dutbxwnp6kdba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7b71014a5535da55491b73d2d1dbab76d822e4bf887cf1a743a4c37b35fe50c2

(this sample)

AgentTesla

Executable exe e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23

AgentTesla

Executable exe 1480e69cac4dec8dba239678446472b12f18cc5e963cc8b7c507a9ccaeaa75cf

  
URLhaus
https://urlhaus.abuse.ch/url/334044/
  
Dropping
MD5 be45bf7f251ecc68fc1210b927aa7453
  
Dropping
SHA256 1480e69cac4dec8dba239678446472b12f18cc5e963cc8b7c507a9ccaeaa75cf
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1480e69cac4dec8dba239678446472b12f18cc5e963cc8b7c507a9ccaeaa75cf

Comments