MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37b445291cc32b37abe2880964f702c7463f11ce2c21ae20d897af8f8b3d9b17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37b445291cc32b37abe2880964f702c7463f11ce2c21ae20d897af8f8b3d9b17
SHA3-384 hash: 051cd7debace1df37fbfa94effc0db84c5b86d7bfab9e305b6e517fb42b30f844cf6ce970af007f46dfb18cc922727ff
SHA1 hash: 1827d1f5d3e2bc472fbd184f7575dad1ea69e69b
MD5 hash: 7f3e99e1c4ff0dbdfb0735c70df3bfe4
humanhash: connecticut-north-charlie-golf
File name:offer - protective products.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:346'812 bytes
First seen:2020-05-07 06:41:56 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:Z2FpxPlLBjg6ZRf2KhBoKsQqAZV0MmG6d0lA9pVJXrhfxdJ+LDO5VKw0IR0:Z2zxtlfR20sFelWcA9Nb1xdJwca
TLSH E57423DBCCE76BF006C9320780F67E463B985BC6DA14913A4F85BA617D8A8333275790
Reporter abuse_ch
Tags:AgentTesla COVID-19 r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hosting.comfrel.org
Sending IP: 162.241.208.147
From: Dale Wu <dalewu2@china-fp.com>
Subject: offer - protective products against covid-19
Attachment: offer - protective products.r00 (contains "offer - protective products.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 03:54:04 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g62ekki4ymvtpk7craewj5ycy5dd6eoofqq24igys6xy7cz5tmlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 37b445291cc32b37abe2880964f702c7463f11ce2c21ae20d897af8f8b3d9b17

(this sample)

AgentTesla

Executable exe 3b96d3e9492d16eed01bb61e349aa7c1096948a9be40fad447872c5ddaf30f2a

  
Dropping
MD5 324f2f33a7dce42099ec54a50a8170ab
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b96d3e9492d16eed01bb61e349aa7c1096948a9be40fad447872c5ddaf30f2a

Comments