MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2893ca8960645cf5f159451de5a41a003218d3650df9e7bcd9c1be7af866987. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2893ca8960645cf5f159451de5a41a003218d3650df9e7bcd9c1be7af866987
SHA3-384 hash: ba293aac9a40c6a2a8d74197bc4c0aee2328499ba43d17a477e8cc3aa180bd8050e8b29a6f5b66a03895a5c994c59bf1
SHA1 hash: 70e2598fdee2e805dd9bf75871e2a2118e1a9934
MD5 hash: 36e640d13f6651df7eca15364ac315e2
humanhash: uncle-vegan-whiskey-jig
File name:Urgent_Order_Request.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:540'806 bytes
First seen:2020-04-06 09:51:40 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:ujk0DfQJMrQaDALmhMOL4vk6GuTXrd1rTcBC819q7kjK:rMrQaDAahVL8fXTcBv1kIK
TLSH 36B42393E1CA70C54321BAA58DC5C1614DF8F723BB8E0CA07A5A535D1CF066BDA7B1AC
Reporter abuse_ch
Tags:AgentTesla COVID-19 r00


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: chathamhouse.org
Sending IP: 103.99.1.159
From: contact@chathamhouse.org
Subject: RE: COVID-19 EQUIPMENT ORDER
Attachment: Urgent_Order_Request.r00 (contains "Urgent_Order_Request.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 10:36:31 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ketzkewazc46xyvsri54wsbuabsddjwkdpz466ntqn6pl4gngdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 e2893ca8960645cf5f159451de5a41a003218d3650df9e7bcd9c1be7af866987

(this sample)

AgentTesla

Executable exe cadf00c7c6778328b6a33baca1814637721c5650961e80f579821c4c46b359d1

  
Dropping
MD5 92e8941be65f43206fb2584da15b3561
  
Dropping
SHA256 cadf00c7c6778328b6a33baca1814637721c5650961e80f579821c4c46b359d1
  
Delivery method
Distributed via e-mail attachment

Comments