MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb61d0a11ae105f17fa29d07ee18df1eb61e4256eb5a30b13551c22a39d75319. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb61d0a11ae105f17fa29d07ee18df1eb61e4256eb5a30b13551c22a39d75319
SHA3-384 hash: 5acae5e4461a7df4c7f4e8a4e2bf5d1d41a2f5cfacb68bdcd1ea29d61e8a95792e3ea003e557811a79d6628e82650180
SHA1 hash: b1563f479806fade9a534b9d6e9f6a882c37beda
MD5 hash: 444c1839172ac5921fe8ac52091c634b
humanhash: one-kentucky-mirror-cola
File name:COVID-19 Customer Market Impact - April 22.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:356'655 bytes
First seen:2020-04-22 12:00:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:a+IQRTj5ayvxnSmAZhXLXcBG9aTUapSA9k1jFKQg2itCc0E4SiVjbK:ajATpJnr4LXcCiUasTjF5dit4EWi
TLSH E37423EF71C216177C00BA5FBD39754E3DB9053F6A2A9DE17D548D502306B3E5988223
Reporter abuse_ch
Tags:AgentTesla COVID-19 rar


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: atomicka.com
Sending IP: 202.52.134.122
From: Nikki Burton <samundeswari.k@milekniran.com>
Subject: COVID-19 Customer Market Impact - April 22
Attachment: COVID-19 Customer Market Impact - April 22.rar (contains "COVID-19 Customer Market Impact - April 22.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-22 12:35:34 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xnq5bii24ec7c75ctud64gg7d23b4qsw5nndbmjvkhbcuooxkmmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bb61d0a11ae105f17fa29d07ee18df1eb61e4256eb5a30b13551c22a39d75319

(this sample)

AgentTesla

Executable exe b9109a10e2bd041f96b560137b5a5f18c0f03fd399d5386793888b596871defe

  
Dropping
MD5 81f45ac71f9972f0a39dae1bef60250a
  
Dropping
SHA256 b9109a10e2bd041f96b560137b5a5f18c0f03fd399d5386793888b596871defe
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b9109a10e2bd041f96b560137b5a5f18c0f03fd399d5386793888b596871defe

Comments