MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9c0becd39338f7d4971e9a63ea0ddf088f84bfcd5568e3823ec0b1cb2e68d20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9c0becd39338f7d4971e9a63ea0ddf088f84bfcd5568e3823ec0b1cb2e68d20
SHA3-384 hash: 9f7b08bf33092e5086ec2decd53f294448adae26bdc90e2367a262520278dbcbdd6927438f2c0c19223d33a30ada434e
SHA1 hash: f86e9eecc752fdbd4351e64e6398ecb774a2f185
MD5 hash: c4ef63fc45e424833b7236be2c6c2be5
humanhash: potato-shade-west-carolina
File name:Hủy thanh toán séc do tăng trong Covid-19.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:444'881 bytes
First seen:2020-04-14 10:02:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:qnhkCF8YOHdyJNGvCQyOR/JoY+61MPRDI+diibNyE7:2hk6/WdyJNG1jJoN61MPCHA
TLSH 45942387BDFFA77F24A8FCB86D034EF46E0235A78499A54B07177DA6637A7830840590
Reporter abuse_ch
Tags:AgentTesla COVID-19 geo rar VNM


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesla, hitting Vietnam:

HELO: linux947.grserver.gr
Sending IP: 178.63.13.15
From: Vietcombank <antonioramoss1997@gmail.com>
Subject: Hủy thanh toán séc do tăng tronag Covid-19
Attachment: Hủy thanh toán séc do tăng trong Covid-19.rar (contains "Hủy thanh toán séc do tăng trong Covid-19.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-14 10:35:31 UTC
File Type:
Binary (Archive)
Extracted files:
63
AV detection:
19 of 45 (42.22%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7hal5tjzgohx2slr5gtd5ig56cepqs742vli4obd5qfrzmxgruqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f9c0becd39338f7d4971e9a63ea0ddf088f84bfcd5568e3823ec0b1cb2e68d20

(this sample)

AgentTesla

Executable exe 10cb43e944707741d8bc5ab4e7d7f6b05a1781c75549b27627cf0a46fae7d9ab

  
Dropping
MD5 c61fe57cb43b2e5107401ec18301ab12
  
Dropping
SHA256 10cb43e944707741d8bc5ab4e7d7f6b05a1781c75549b27627cf0a46fae7d9ab
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10cb43e944707741d8bc5ab4e7d7f6b05a1781c75549b27627cf0a46fae7d9ab

Comments