MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fb2969a871dffd11e4b86d2a73c489b8e5e9e92997c1e0b61902701b5956d7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fb2969a871dffd11e4b86d2a73c489b8e5e9e92997c1e0b61902701b5956d7b
SHA3-384 hash: 949c2c249209c6bd7beadab62c14d45342285731a05f3fbe335774f7a34129816d5a30e67dd42e27bc88f45b71150a6a
SHA1 hash: 32dacca5134fdca95e55f95989fa6e3c7619788e
MD5 hash: 967c6cb147e5228495e8507f2b50c296
humanhash: golf-floor-connecticut-triple
File name:FM_SCM_1.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:383'891 bytes
First seen:2020-03-30 11:34:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:CeWKJ8gLZq5yXlkyEasx5V56b/BqxsUMrA0OUjgIEBqO/Z/fQOzzc5QLQuLeI+CO:IKJDq2JIvg/BqxsUg4fBqOaOHcnqeX64
TLSH B48433052A89198FBC77CC0F94ABD397A6B5DE8217BB48F35FC8555202175A803C98FC
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: sourceintelligence.com
Sending IP: 185.118.166.15
From: WANKAR, Ninad <circor@sourceintelligence.com>
Subject: COVID-19 Update
Attachment: FM_SCM_1.zip (contains "FM_SCM_1.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587 (77.88.21.158)

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.45940.15049.5261.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Gdsda
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 11:35:50 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
22 of 47 (46.81%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6zjnguhdx75chslq3jkopcitohf5hustf6b4c3bsatqdnmvnv5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5fb2969a871dffd11e4b86d2a73c489b8e5e9e92997c1e0b61902701b5956d7b

(this sample)

AgentTesla

Executable exe 420d2d11f2a47d6001c52c27be90bb4c1221242af9b5c44381d0012e84aa75b3

  
Dropping
MD5 fd991bcaca8b8a86db1ddf618f39d7a1
  
Dropping
SHA256 420d2d11f2a47d6001c52c27be90bb4c1221242af9b5c44381d0012e84aa75b3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments