MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 953d002629b07478d91227304c627b02a22628fd0e6722cbfcff44a09a76a701. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 953d002629b07478d91227304c627b02a22628fd0e6722cbfcff44a09a76a701
SHA3-384 hash: 79b50f69580e376888e7ed95af68ea4fb770cc7537615af21bbb478ce56f9e5a7ce451e9f33cb236ac3f0cf46f0eef50
SHA1 hash: d1892e3dfc303156f8b46cebfa4d4b5f1c9fa9f0
MD5 hash: 88cdc193fd6c84c52fb8ac0ccd006367
humanhash: bulldog-minnesota-speaker-pasta
File name:IMPORTANT INFORMATION.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'507 bytes
First seen:2020-04-15 17:22:04 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:Q7LmbbuO/MmIDGmR990X9wLhkSbVeFA/5BxD+RyXi:Q7yiO/Mm40X9wLhkSaA/N+Qy
TLSH B7942305EDA9D2CAD37A6B3BF65C930AA1A74E5E7803784F6FC0DDE336B0940D942650
Reporter abuse_ch
Tags:AgentTesla COVID-19 r00


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: pascargousa.com
Sending IP: 103.99.1.159
From: no-reply@pascargousa.com
Subject: COVID19 ANNOUNCEMENT #002
Attachment: IMPORTANT INFORMATION.r00 (contains "IMPORTANT INFORMATION.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587 (77.88.21.158)

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-15 17:35:26 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
26 of 45 (57.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=su6qajrjwb2hrwise4yeyyt3akrcmkh5bztsfs7475ckbgtwu4aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 953d002629b07478d91227304c627b02a22628fd0e6722cbfcff44a09a76a701

(this sample)

AgentTesla

Executable exe 6ce82de9b05b1a5e2cee73e45292f3e06aa8df33c904724ea5f5bdd536d44c39

  
Dropping
MD5 2d7fc68eff99629ccdc020836ad92cb3
  
Dropping
SHA256 6ce82de9b05b1a5e2cee73e45292f3e06aa8df33c904724ea5f5bdd536d44c39
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ce82de9b05b1a5e2cee73e45292f3e06aa8df33c904724ea5f5bdd536d44c39

Comments