MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7b3a56939095392fb47b1ebecde3a0f23f5043c9813271953c9c2e09d975fd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7b3a56939095392fb47b1ebecde3a0f23f5043c9813271953c9c2e09d975fd4
SHA3-384 hash: 81bb6df8b52f86cc0556dc30cc7c3d7c9bd4e6ac926cf3efe44ac76195e21897eb03112f158b3127af1e86a179dbcce0
SHA1 hash: 38eba093768da4c9c9d2dc353b5bf42e1c13046e
MD5 hash: e225e98fe627f9db6db7664e26c20cfa
humanhash: happy-triple-hawaii-echo
File name:FUNDOS DE ALiVIO COVID-19.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'514'352 bytes
First seen:2020-04-14 17:34:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:k1ryMN45FcGH9tKQxX98FWVhU5NK4drcaHxVh1QfLTQvhLGzwlqBtZEYC+9zGDJ5:k1x45brKQh98ECnDlVTVGMlqBtZr9z4/
TLSH 7565337C88BBDC57CDB82C099F00646B30A558317AE61FE7C89A0B74D8E5D457B06BA3
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: foe.com
Sending IP: 173.82.155.122
From: GAIL <GAIL@gailimited.pt>
Subject: FUNDOS DE ALÍVIO COVID-19
Attachment: FUNDOS DE ALiVIO COVID-19.zip (contains "FUNDOS DE ALiVIO COVID-19.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.Generic.vh.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Aitinject
Create hunting rule
Status:
Malicious
First seen:
2020-04-14 17:35:24 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
28 of 45 (62.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=26z2k2jzbfjzf62hwhv6zxr2b4r7kbb4tajsogktzhbobhmxl7ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d7b3a56939095392fb47b1ebecde3a0f23f5043c9813271953c9c2e09d975fd4

(this sample)

AgentTesla

Executable exe 510747474c1705beb2d01401d2ad0ca50ceb251122d954d6744507f94eb35384

  
Dropping
MD5 ec669285e03b127fa3f5b894730798f8
  
Dropping
SHA256 510747474c1705beb2d01401d2ad0ca50ceb251122d954d6744507f94eb35384
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 510747474c1705beb2d01401d2ad0ca50ceb251122d954d6744507f94eb35384

Comments