MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51004572124d5de01dc7795e6154ddd19192e78edf63d2e3bf89d61316a1d0e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51004572124d5de01dc7795e6154ddd19192e78edf63d2e3bf89d61316a1d0e6
SHA3-384 hash: 02bd0b51ebfc5289639ca13704c1ded48e189e089c1d911983f92ee85bbf25c9fb2d1d8f5315b98eb67de7e5319daff5
SHA1 hash: cac5cf9af1ec3a3aba23f80d4947394ccc01cd04
MD5 hash: 3bc83d4d20986c786c2a52bdd14832dd
humanhash: mars-shade-uniform-king
File name:SKM_C3350191107102300.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:458'297 bytes
First seen:2020-08-14 09:52:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:HeBYGZH21csdxTGLFRocG7j826To1mwv3/KBCB:HYYsW1LdZGZqTcXTcmwv3EO
TLSH 62A4232C06E3D0C9E10AB7B49490264659DFA339FF3F7F48AD1F39AD90C459D28EA814
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps193.pairvps.com
Sending IP: 66.39.65.125
From: Kristine Noveno <info@orglogistics.com>
Subject: ADVANCE FREIGHT USD INV#1191189
Attachment: SKM_C3350191107102300.rar (contains "SKM_C3350191107102300.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51004572124d5de01dc7795e6154ddd19192e78edf63d2e3bf89d61316a1d0e6/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 09:54:07 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=keaek4qsjvo6ahohpfpgcvg52gizfz4o35r5fy57rhlbgfvb2dta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/51004572124d5de01dc7795e6154ddd19192e78edf63d2e3bf89d61316a1d0e6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 51004572124d5de01dc7795e6154ddd19192e78edf63d2e3bf89d61316a1d0e6

(this sample)

AgentTesla

Executable exe 1631bd051bd9ef096e2cd29bba5c549e8b4028dc9de457c2bd5ee060c69a7e6a

  
Dropping
MD5 3ecd7b16cf441354ab7c4bcea3971783
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1631bd051bd9ef096e2cd29bba5c549e8b4028dc9de457c2bd5ee060c69a7e6a

Comments