MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9fe7815e0a80b07d8320c48a6e59832b4a6e097adb1d0e480aae974feb0fa43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9fe7815e0a80b07d8320c48a6e59832b4a6e097adb1d0e480aae974feb0fa43
SHA3-384 hash: ec2dc21a3bf76928541d9714debc501c516215fed9623987ccc11de8ea0f12985a8c23a62fa934881d9199b449e39efc
SHA1 hash: a2ae385643b566d9cac1c08535d3144ad4f6a898
MD5 hash: a8902b3006706981e9baf2d03b954e52
humanhash: emma-five-fourteen-equal
File name:Corona virus COVID-19.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'294'789 bytes
First seen:2020-04-06 10:44:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:aWriQlhAK9PNvkeyAK6NoCMc8pf5TwWEHAKpMRk0wSiC02JClj5zQR1RlHSNV:at+n9JpxN1eRTUVpV9aJEOhsV
TLSH 0D553351F47E235B8CB9FD4E9289B31961481B4AAC1051F29E4B33B067650BB6FBCB08
Reporter abuse_ch
Tags:AgentTesla COVID-19 rar


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: tgi.com
Sending IP: 103.125.190.246
From: Dr Eric <canada@tgi.com>
Subject: COVID-19 Explore Laniado Hospital latest update
Attachment: Corona virus COVID-19.rar (contains "Corona virus (COVID-19).exe")

AgentTesla SMTP exfil server:
mail.marmarisferry.com:587 (212.83.158.53 - info@marmarisferry.com)

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 11:36:27 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5h7hqfpavafqpwbsbreknzmygk2knyexvwy5bzeavluxj7vq7jbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e9fe7815e0a80b07d8320c48a6e59832b4a6e097adb1d0e480aae974feb0fa43

(this sample)

AgentTesla

Executable exe bcb14358725125f3e9a64fe937211cee10fb133f031a631f23b53a08e38c4fdb

  
Dropping
MD5 a53b3f6a7e651f79bf3e651393db66c8
  
Dropping
SHA256 bcb14358725125f3e9a64fe937211cee10fb133f031a631f23b53a08e38c4fdb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bcb14358725125f3e9a64fe937211cee10fb133f031a631f23b53a08e38c4fdb
Cape
Cape
https://www.capesandbox.com/analysis/761/

Comments