MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4a20fee4e25bb951da79493670bf0dec220e36b8e89948b058df66175c591f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4a20fee4e25bb951da79493670bf0dec220e36b8e89948b058df66175c591f5
SHA3-384 hash: 4a257e5c69324e5fd23cb42cf8fe3c83229c0ed387a706ed823dba4b8108d1416cce3e5e8c7542789a9eca6c7ac63b73
SHA1 hash: 50bdd815b68aea418637ec6d3fd529c7f31f37a8
MD5 hash: c3331d2175ef71b293472cdcaa072d54
humanhash: spring-zulu-king-snake
File name:PO For-COVID-19 Products.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'478'163 bytes
First seen:2020-03-30 11:09:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:selVQh4+TU+1+zh00JUFRDbZiyw2ud0Hs+tzKVDko:selVmRwI+a0JUFZBw2RHjtzyZ
TLSH DA653395636B6BBD316C16E7B123975881306C2B8E1EAB3BDE437CFD7A10C1535AA304
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: wayne.acenet.us
Sending IP: 68.171.211.59
From: roseline@reynoldsgh.com
Subject: Purchase Order (PO For-COVID-19 Products)
Attachment: PO For-COVID-19 Products.zip (contains "PO For-COVID-19 Products.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 11:35:53 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
16 of 47 (34.04%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2sra73soew5zkhnhssjwoc7q33bcby3lr2ezjcyfrx3gc5ofsh2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d4a20fee4e25bb951da79493670bf0dec220e36b8e89948b058df66175c591f5

(this sample)

AgentTesla

Executable exe 83457e2b8f9209ec1c987b1a0bee65140cc41d1d59ed38f1d1ad160ea0d1d13c

  
Dropping
MD5 6b52e6e93ec0774bc275e3f82ddd0d15
  
Dropping
SHA256 83457e2b8f9209ec1c987b1a0bee65140cc41d1d59ed38f1d1ad160ea0d1d13c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 83457e2b8f9209ec1c987b1a0bee65140cc41d1d59ed38f1d1ad160ea0d1d13c

Comments