MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30f4f7e183705122849741988a0005590cd0a95287abd7b03a09a0b878b468e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30f4f7e183705122849741988a0005590cd0a95287abd7b03a09a0b878b468e9
SHA3-384 hash: d583362a9dea18bbc48e532c1d4c2f10828ae413531422e3bc9709e1a3e9a9ca5d8214927b39ec8eb6bc2f84091c6b4c
SHA1 hash: e07d27d584f39c9c8d93b7b7dcfcd41de57f031c
MD5 hash: 709e121dbe82bcd02485e70b056fa613
humanhash: gee-burger-juliet-iowa
File name:Covid Order.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:442'454 bytes
First seen:2020-04-30 06:08:20 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:e2D0RvtMVAaFwTyGH30fRD8s2qvG6ijl4NZvPtoZ4eG:eiUv4AaFwTyMUTlGhlsVtobG
TLSH 5C94233095B42D8DBBEB4739C2EEE00A58DF61863B5237624E0D2B496CC1BF57577282
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cgc-kw.com
Sending IP: 37.49.230.116
From: Ranjith.valappil@cgc-kw.com
Reply-To: Ranjith.valappil@cgc-kw.com
Subject: New Order
Attachment: Covid Order.gz (contains "Covid Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 08:27:10 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gd2ppymdobisfbexigmiuaaflegnbkksq6v5pmb2bgqlq6funduq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 30f4f7e183705122849741988a0005590cd0a95287abd7b03a09a0b878b468e9

(this sample)

AgentTesla

Executable exe 1b118ca52854a3b93972f45bb855b53619989ccd40bda3e9c5ec068690e63175

  
Dropping
MD5 06743dcd7600d023c38782c676ed400a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b118ca52854a3b93972f45bb855b53619989ccd40bda3e9c5ec068690e63175

Comments