MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3080de2c9994f61c5aabbcc4dff059ac79e0eb6f3be518b4db538ff767a740a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3080de2c9994f61c5aabbcc4dff059ac79e0eb6f3be518b4db538ff767a740a3
SHA3-384 hash: 7d3f697c5b8495094a3da71ff48a8363ee496bd1742e6a763ce7839efd3ee4877586874889ed9df348ff1689aa2409e6
SHA1 hash: 1542a25f4a7891f70b93f7dd46afd4648c8ea09b
MD5 hash: 47ef56c6475462873df3f0bfec80c8f4
humanhash: orange-georgia-kansas-stairway
File name:Face MasksKN95.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:438'457 bytes
First seen:2020-04-01 13:41:39 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:IO5OSFmIiMivkcz7mlUSU/8jqw8A59cOmiy:IMO0ivkQmO/xw80hmP
TLSH 4E9423D3E2899FAE0A4BD7F491700F2E7D13DA2942A2C10CB2511DED34459676733EBA
Reporter abuse_ch
Tags:AgentTesla COVID-19 z


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: mail0.restapow.xyz
Sending IP: 104.168.145.174
From: Tina Meng -Sales <Tina@planetgroup.cn>
Subject: Face Masks and KN95 COVID -19
Attachment: Face MasksKN95.z (contains "Face Masks&KN95.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587 (77.88.21.158)

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 14:35:29 UTC
File Type:
Binary (Archive)
Extracted files:
49
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gcan4lezst3bywvlxtcn74czvr46b23phpsrrng3koh7oz5hicrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 3080de2c9994f61c5aabbcc4dff059ac79e0eb6f3be518b4db538ff767a740a3

(this sample)

AgentTesla

Executable exe d7b59d350dd16d5c6a39706ba5dade34574798379ac54f0fa0cbea42158435ac

  
Dropping
MD5 9bf72d33a239963ca6098752cec3ef9c
  
Dropping
SHA256 d7b59d350dd16d5c6a39706ba5dade34574798379ac54f0fa0cbea42158435ac
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7b59d350dd16d5c6a39706ba5dade34574798379ac54f0fa0cbea42158435ac

Comments