MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adbadbfdd03e7e142aa7339353f11e82561594ee2ceb2f244a2ccdd1ddb1de1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: adbadbfdd03e7e142aa7339353f11e82561594ee2ceb2f244a2ccdd1ddb1de1e
SHA3-384 hash: f0d220e8c8e46e7c0834e26eae5608aa9e5269aa96f6e0de0037c8dc9636ff8ce0fae514b98427196a38a9195ed63792
SHA1 hash: 25923c6972fe0da9c2d8381f883bbde92ed58ba4
MD5 hash: 1b3210c320e57ba5fbd7fb9832848225
humanhash: quebec-beer-william-summer
File name:payment invoice_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'038'212 bytes
First seen:2020-05-13 10:06:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:s8fB2jMXoWpz7cihM/KXnu9NHX/Ne432FQ9VoIVTDi:s852Hkz1KCu73lNmFQHoIRi
TLSH 142533D8F1477EC65DEC6A2162503D237FB40B42A7BC16C1AC8EF358CE6B85E5918293
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.primetechmachinery.com
Sending IP: 192.99.54.229
From: Shabeer M. T. <shabeermt@remegfeed.com>
Subject: Payment Assistance Due To Covid-19 Pandemic
Attachment: payment invoice_pdf.zip (contains "payment invoice_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 04:36:45 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vw5nx7oqhz7bikvhgojvh4i6qjlblfhoftvs6jckftg5dxnr3ypa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip adbadbfdd03e7e142aa7339353f11e82561594ee2ceb2f244a2ccdd1ddb1de1e

(this sample)

AgentTesla

Executable exe d602c9b3a7c2afa7bb61931a544fe74ad9cade7d222d72d52c2f3790966f964c

  
Dropping
MD5 7ef1aca610ff70791941cadf910ef3aa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d602c9b3a7c2afa7bb61931a544fe74ad9cade7d222d72d52c2f3790966f964c

Comments