MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10aff3d670cd8315b066b6c5423cf487c782ac83890aa4c641d465ef2df80810. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10aff3d670cd8315b066b6c5423cf487c782ac83890aa4c641d465ef2df80810
SHA3-384 hash: 4ceb1ed72171526741b08077c571bbf149b2389ed4d84d687d771122db03243450b1eea43b26cc763ab2175997e61a5d
SHA1 hash: f1e8e287a6429928b49a61a5263a40ea276cd3b2
MD5 hash: 725e46bfaaf254c608d70836ba89734e
humanhash: pluto-oscar-minnesota-spring
File name:WARNING OF CORONA VIRUS COVID-19 BEWARE COVID 19 IS WITHIN.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'572'864 bytes
First seen:2020-04-07 06:59:00 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:uJs5zbW+MmtE6ZiaiOFL1V/mnPSfhrIKRmp5gw:uJs5zw2ZioL/a4rIKwHT
TLSH DA75AD2FD9696422EE9A1532C4A04FD9953B9C143321DBCBB89ABF1931CC781717F70A
Reporter abuse_ch
Tags:AgentTesla COVID-19 img


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: 162-241-214-72.unifiedlayer.com
Sending IP: 162.241.214.72
From: HR Department <HR@victim-domain>
Subject: CORONA VIRUS COVID-19 PANDEMIC IS WITHIN, BEWARE! WARNING!!! WARNING!!! WARNING!!!
Attachment: WARNING OF CORONA VIRUS COVID-19 BEWARE COVID 19 IS WITHIN.IMG (contains "WARNING OF CORONA VIRUS COVID-19 BEWARE! COVID 19 IS WITHIN!!!.exe")

AgentTesla SMTP exfil server:
smtp.recornit.com:587 (208.91.199.223)

AgentTesla SMTP exfil email address:
sales@recornit.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-07 07:36:21 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ccx7hvtqzwbrlmdgw3cuephuq7dyfledrefkjrsb2rs66lpybaia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 10aff3d670cd8315b066b6c5423cf487c782ac83890aa4c641d465ef2df80810

(this sample)

AgentTesla

Executable exe 0a6f58799573f8dc4cab3ceb48832902460b893bc5607cb77ade332b7d4f3a91

  
Dropping
MD5 fb94a873a87e7feb02b3178566e364d7
  
Dropping
SHA256 0a6f58799573f8dc4cab3ceb48832902460b893bc5607cb77ade332b7d4f3a91
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a6f58799573f8dc4cab3ceb48832902460b893bc5607cb77ade332b7d4f3a91

Comments