MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc502f9df7767e1a0a01e13dad15920112230534f92d274ba0fd317c2e0b1cfd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc502f9df7767e1a0a01e13dad15920112230534f92d274ba0fd317c2e0b1cfd
SHA3-384 hash: 04630220e4a6c2b4d55686e7e6a31d9e970a012ad7b6cea0f81bed410ebfe92a328d0023fb91597cb7e1885ecb8ffe3b
SHA1 hash: 81ff7338b676f5650e7d97cd1147eef9e5cebbbc
MD5 hash: aada636cf06553519c9dbd14b3bd191b
humanhash: tennessee-yankee-red-steak
File name:Document 13042020-245784672009856905957758598.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'162'688 bytes
First seen:2020-04-13 08:26:39 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:cdG8BXzevU130jYxANjNT6FQm1aLHhW4EhGqT+NuJsHKq7+tWBvJ/h6D4tt5Vqzx:CG8VeK72LrEhjqbKqatWj/h6E
TLSH 4BA5C081F6C190F1EA910071BD65D7AE5F327C118D20AA17B7DC3E1E8BBF5406A2B279
Reporter abuse_ch
Tags:AgentTesla COVID-19 img


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: server.eurolotteria.com
Sending IP: 142.4.9.187
From: Managing Director<md@victim-domain>
Subject: Evidence Document Containing Staff Misconduct During This Period Of COVID-19 Pandemic 13-04-2020
Attachment: Document 13042020-245784672009856905957758598.img (contains "Document 13042020-245784672009856905957758598.exe")

AgentTesla SMTP exfil server:
smtp.maizinternational.com:587 (208.91.199.223)

AgentTesla SMTP exfil email address:
sales@maizinternational.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Kuaizip-6840562-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-12 22:42:11 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ric7hpxoz7bucqb4e622fmsaejcgbju7ewsos5a7uyxylqldt6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img dc502f9df7767e1a0a01e13dad15920112230534f92d274ba0fd317c2e0b1cfd

(this sample)

AgentTesla

Executable exe 4771ad2ea30c1ac1dbf9e6358478b9fd0d6525a4b9c19e0610f7accd1d1151af

  
Dropping
MD5 4b7d782e9374dbd44819b941cf0ebdde
  
Dropping
SHA256 4771ad2ea30c1ac1dbf9e6358478b9fd0d6525a4b9c19e0610f7accd1d1151af
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4771ad2ea30c1ac1dbf9e6358478b9fd0d6525a4b9c19e0610f7accd1d1151af

Comments