MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3e064f7c60b60b06c839a6c8f448abddd773e997f56dce69577ed6ab0b86974. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3e064f7c60b60b06c839a6c8f448abddd773e997f56dce69577ed6ab0b86974
SHA3-384 hash: 43a4303f17602806173e1ca1da1672d8cccc056edb34bf0188e42e4ab1bf8101fcbc122b5e71552b8e4f2493a81fe938
SHA1 hash: afc0427f7405cbb9ea94a7c2498f9fd0b700380d
MD5 hash: 9aa6ff28c8f10659644801869e4e3881
humanhash: texas-uncle-california-kentucky
File name:Request Items.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:490'225 bytes
First seen:2020-04-21 11:54:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:rf14NwfQGyt5rx4ayl6hVubJkWjue0W/srM3O2JFE62:buNY3yt5tny0tgue0Wk+XE62
TLSH 71A4239F9122C8C98DC93C8D664678B1D4520AF4983F5ED38A4F62A4ACC52DCF1F46E7
Reporter abuse_ch
Tags:AgentTesla COVID-19 rar


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: smcc.wsiph2.com
Sending IP: 67.198.209.31
From: Timothy Mung'oma <sms_cvlqs@smcc.com.ph>
Subject: Request For Quotation For Supply of COVID-19 Relief Material Urgent
Attachment: Request Items.rar (contains "Request Items.exe")

AgentTesla SMTP exfil server:
mail.modevnigeria.com:587 (162.241.194.86)

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-21 12:35:31 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpqgj56gbnqla3edtjwi6rekxxoxopuzp5lnzzuvo7wwvmfynf2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b3e064f7c60b60b06c839a6c8f448abddd773e997f56dce69577ed6ab0b86974

(this sample)

AgentTesla

Executable exe 3146e047d6021c93280619fc4b62a7bc945d70cd21163c05fad4e0048ce5d505

  
Dropping
MD5 7b6d1d2e5051dca5ca29055cf34773ef
  
Dropping
SHA256 3146e047d6021c93280619fc4b62a7bc945d70cd21163c05fad4e0048ce5d505
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3146e047d6021c93280619fc4b62a7bc945d70cd21163c05fad4e0048ce5d505

Comments