MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4bfc19d06e21fbdfaeb1c10bc82a90665872621ab5322d9f7242a06459366d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4bfc19d06e21fbdfaeb1c10bc82a90665872621ab5322d9f7242a06459366d3
SHA3-384 hash: 00f853ede6f682852db5e37b7d9c1e833a9e19e242cae9b0e29d25558dd8d8558e651e38955bf6aedb63c7915b813c02
SHA1 hash: b3ae1b24b5b87fa112a5e4c5dce517111ab40cb5
MD5 hash: 42fca6b3efc1e318964196cd78da68b1
humanhash: idaho-mirror-undress-nineteen
File name:New Order Docx.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:463'544 bytes
First seen:2020-04-20 14:49:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:x4WOnxn6DGw/H3dXHWWywhTdK1mzUZ1AmG9UpmTv+vlhK:s6D9FJFhTdnUZ1a8M
TLSH 12A42383891F660E01762EDD1FC6B07F9CFF9C301E49AAD1AB3850D642A4E291E507F9
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: smtp114.iad3a.emailsrvr.com
Sending IP: 173.203.187.114
From: SAINT JUDE INT`L. EXPORT CORP. <pablo.lozada@andron.co.uk>
Subject: Purchase Order=FHI 5535/04/20
Attachment: New Order Docx.zip (contains "New Order Docx.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587 (77.88.21.158)

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.AgenslaNET.1.31067.21248.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-20 15:35:29 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ys74dhig4ip336xldqilzavjazsyojrbvnjsfwpxeqvamrmtm3jq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c4bfc19d06e21fbdfaeb1c10bc82a90665872621ab5322d9f7242a06459366d3

(this sample)

AgentTesla

Executable exe 5f298f29f101caea92cc338b2f54805748ca316c2f29c2d1a533c28105d93b4b

  
Dropping
MD5 46ef7ac80b030441eaa3eec9ea13f805
  
Dropping
SHA256 5f298f29f101caea92cc338b2f54805748ca316c2f29c2d1a533c28105d93b4b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f298f29f101caea92cc338b2f54805748ca316c2f29c2d1a533c28105d93b4b

Comments