MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8dc656b53b7ed3b85e4a803a59449d372ad6609dbec7da769c45acf4cdc2472. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8dc656b53b7ed3b85e4a803a59449d372ad6609dbec7da769c45acf4cdc2472
SHA3-384 hash: 0937b6105a9643698053a2b6954f159b38f5768699f732647b4cd4ad7e54543fb5956c2a3399f0913384ad8d44985c2a
SHA1 hash: 74dc1c43b89bcbe390c399dd770dd9f2e17f88fc
MD5 hash: 42f387becf6d1bd05e44cacfc75fefb0
humanhash: hamper-idaho-high-zebra
File name:URGENT TENDER675320 Covid19 kits.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:339'143 bytes
First seen:2020-05-11 14:11:16 UTC
Last seen:2020-05-11 14:11:25 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:cqf+k4hn8RMCAu8449fEejR7GTiCTFs2t3xHMjzgRfjh:tfnwdI49E2aiaBV4zejh
TLSH 2A7423851F099F0891BDA84DA13A0F4E446D0EBC14CE97D680FFAA78F5716C9AEB54A0
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: out-mta79.ai270.net
Sending IP: 94.126.40.79
From: susan <susan.conejos@muhelconsulting.com>
Reply-To: Susan.conejos <qmi19@bk.ru>
Subject: URGENT TENDER#675320 (Covid19 kits)
Attachment: URGENT TENDER675320 Covid19 kits.zip (contains "URGENT TENDER#675320 (Covid19 kits).exe")

AgentTesla SMTP exfil server:
twire.icu:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/360202
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 14:37:07 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xdogk22tw7wtxbpevab2lfcj2nzk2zqj3pwh3j3jyrnm6tg4erza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b8dc656b53b7ed3b85e4a803a59449d372ad6609dbec7da769c45acf4cdc2472

(this sample)

AgentTesla

Executable exe 5b37cc85fd190a6b4726ea57f2588b5a74acc2c51e2917363c226b73ac79118f

  
Dropping
MD5 bd2aeaab8f491a77f7c7ce59b027cf2c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b37cc85fd190a6b4726ea57f2588b5a74acc2c51e2917363c226b73ac79118f

Comments