MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d346fb742a8c538e978a592443f8686c1f502c00f6e06aabe42d117679ab6c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d346fb742a8c538e978a592443f8686c1f502c00f6e06aabe42d117679ab6c6
SHA3-384 hash: 95c0ef0c1a08b6bbb4a8a4133de75e683b244a92cc4598de87e90f15968a4c8c9563a7cce2ae1cc96fbaf700431de96d
SHA1 hash: b2a2e61335c208b284f974f447379cfa7db99337
MD5 hash: 4913568685c82700275b3e085379a0ea
humanhash: queen-texas-eight-quiet
File name:vaccine release for Corona-virusCOVID-19_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:25'342 bytes
First seen:2020-04-03 17:22:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:PZG5fxtC80j2e3q27TrRZeLqB1gPWi8o/lEh2ULVnP7n:BGSjwkT4uifI2UJnD
TLSH 24B2E0A261B1ECD55E2C0C6CB12CE752FD4882D09FF59AFD176821943D8D53C9BAE40E
Reporter abuse_ch
Tags:AgentTesla COVID-19 GuLoader rar


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader->AgentTesla:

HELO: server.kto.org.tr
Sending IP: 185.135.222.3
From: Dr. Kim Jung <info@hardworkingincs.pro>
Subject: Latest vaccine release for Corona-virus(COVID-19)
Attachment: vaccine release for Corona-virusCOVID-19_pdf.rar (contains "vaccine release for Corona-virus(COVID-19)_pdf.exe")

GuLoader payload URL (AgentTesla):
https://drive.google.com/uc?export=download&id=1Trzyb2eW-3WLdj4BQQq_kissPU1THWy5

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587 (208.91.198.143)

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-03 17:35:46 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ju2g7n2cvdctr2lyuwjeip4gq3a7kawab5xankv6iliroz42w3da._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4d346fb742a8c538e978a592443f8686c1f502c00f6e06aabe42d117679ab6c6

(this sample)

AgentTesla

Executable exe 2cf671173d9af2f550adcb58b7c8aa914164d52400363680cf476af85b9bfab2

AgentTesla

Executable exe c8a4bb98cbc68663e4a07d58c393c00797365a2f3305d039809554a72e2bd01e

  
URLhaus
https://urlhaus.abuse.ch/url/334542/
  
Dropping
MD5 c957a5f737c9d386b24b368b43ef8a5e
  
Dropping
SHA256 c8a4bb98cbc68663e4a07d58c393c00797365a2f3305d039809554a72e2bd01e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c8a4bb98cbc68663e4a07d58c393c00797365a2f3305d039809554a72e2bd01e

Comments