MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6794a030da430f6a4d8312899f7e628df4f3e80cfbd090eba5ba9aee233f70b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6794a030da430f6a4d8312899f7e628df4f3e80cfbd090eba5ba9aee233f70b0
SHA3-384 hash: f39e64d6d8e542c0d9a7676de5c14e1764c1a906b5165f07f64eb5bfa3e4806c7c3b61011430b31f9f619a0cfa68733b
SHA1 hash: c368a106fd3e67c92d2139574fddbfd6166d3ccf
MD5 hash: b2ccd98b0fb37387d24c94235b248453
humanhash: november-hawaii-princess-quiet
File name:Photos of our staff with the COVID-19 viral infection.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'031'616 bytes
First seen:2020-04-21 12:55:15 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:uNqd0SEhgDnzhuHaM19VqAjk5so88OnNC+1c3YGpTUkTd3OXCBQ9co6q0lpcPPiV:nd6gD83OdgAPTp
TLSH 9E958FE2DE1B926AF74B257DBB5C72D0B89CB7011F7F0C1A38CCE51C56679A1088E960
Reporter abuse_ch
Tags:AgentTesla COVID-19 img


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: mail.trigunamandala.co.id
Sending IP: 103.227.147.230
From: "Shahzad Akbar" <anin@trigunamandala.co.id>
Subject: Photos of our staff with the COVID-19 viral infection
Attachment: Photos of our staff with the COVID-19 viral infection.img (contains "PHOTOS_O.EXE")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33701317.9125.13914.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dropback
Create hunting rule
Status:
Malicious
First seen:
2020-04-21 09:29:50 UTC
File Type:
Binary (Archive)
Extracted files:
51
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6kkamg2imhwutmdckez67tcrx2ph2am7pijb25fxkno4iz7ocya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 6794a030da430f6a4d8312899f7e628df4f3e80cfbd090eba5ba9aee233f70b0

(this sample)

AgentTesla

Executable exe c3820448fb9d548a6e581c0fbf4bb3716d2cb945ba790a8fab3fd02ac3ec844b

  
Dropping
MD5 8d99214e831842025f9a3101cde59456
  
Dropping
SHA256 c3820448fb9d548a6e581c0fbf4bb3716d2cb945ba790a8fab3fd02ac3ec844b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3820448fb9d548a6e581c0fbf4bb3716d2cb945ba790a8fab3fd02ac3ec844b

Comments