MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f178d7b7e460aa3d432b781fe883115e9b5f02a58e367e1f10d731f7eb4b5eda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f178d7b7e460aa3d432b781fe883115e9b5f02a58e367e1f10d731f7eb4b5eda
SHA3-384 hash: 83e23df84833716a4df92563a9b7dc4d8d4b669f6b3e001222989c1c3abbd2ce919bfb4c940c5eff2a91ed3493730752
SHA1 hash: cfada1ff729bf9f3f8c4d3cb408ec9aa830300f0
MD5 hash: 4086b22bff72a3e7b27b8a8bdee6e712
humanhash: wyoming-comet-robert-charlie
File name:Cotización de productos anti COVID-19..........pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:435'348 bytes
First seen:2020-04-17 08:25:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xIZzCEHA81mEdQIG0zI3Y5R7EJO4eyNJfSiOkf:MCEHt5dP83Y88KNJMY
TLSH C1942319CB0F41F7C9A353CCBF51A0225BE9A964DBC11AA16B5E2DDDC9891A0C7B00ED
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla:

HELO: mvegypt-server1.mvegypt.com
Sending IP: 64.235.40.5
From: marketing@medicaldimegar.com.mx
Subject: Presupuesto para productos Anti COVID-19
Attachment: Cotización de productos anti COVID-19..........pdf.zip (contains "Cotización de productos anti COVID-19..........pdf.exe")

AgentTesla FTP exfil server:
ftp.motocoroneos.gr:21 (93.174.123.235)

AgentTesla FTP exfil user:
offshore@motocoroneos.gr

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.278.13852.10590.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-17 08:35:34 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
25 of 47 (53.19%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6f4npn7emcvd2qzlpap6rayrl2nv6avfry3h4hyq24y7p22ll3na._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f178d7b7e460aa3d432b781fe883115e9b5f02a58e367e1f10d731f7eb4b5eda

(this sample)

AgentTesla

Executable exe 8425c75594dede14f2b9c7810e6c8824c7666329eee6866beed84e1f7674bc70

  
Dropping
MD5 d7181ce8ff76671d99b0c544a658f083
  
Dropping
SHA256 8425c75594dede14f2b9c7810e6c8824c7666329eee6866beed84e1f7674bc70
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8425c75594dede14f2b9c7810e6c8824c7666329eee6866beed84e1f7674bc70

Comments