MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51145509f9005a131cca5866511cd72dee4e0dfe67e2f7139ab1870a9fbf38e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51145509f9005a131cca5866511cd72dee4e0dfe67e2f7139ab1870a9fbf38e4
SHA3-384 hash: 69ca9faefd85f4338b448ea89749340eb0651988ff9e5d4ba32c335f39e43b555395219a7124051407fcc3ddcb86f82b
SHA1 hash: a94412a2bd7c2b5978a0c9c6734adaed0c44a909
MD5 hash: 34121d1ef6770eb390c6c788d164fac7
humanhash: oven-hotel-delta-harry
File name:New Order 6546_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:438'019 bytes
First seen:2020-04-30 08:37:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:S/Ubz6YZ7oOL5RvJ9igPdbJF5580ZCJCRuogpO/ltME5+uYC8aDnoIbN5nUrLy:S/wOOLz3RF5ZaEuFO/lyE5+Ta8Y5UrG
TLSH 6894238B226497CC39C83BD76ECDDD035D9D27899C9819E2907B4D934C323EC946C6A9
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps1.imagaza.com
Sending IP: 188.165.205.198
From: Purchase/Rolf Mayer <purchasse@ansamcal.com>
Subject: New Order #6546 / 04-28-2020
Attachment: New Order 6546_pdf.rar (contains "New Order #6546_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 09:36:26 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kekfkcpzabnbghgklbtfchgxfxxe4dp6m7rpoe42wgdqvh57hdsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 51145509f9005a131cca5866511cd72dee4e0dfe67e2f7139ab1870a9fbf38e4

(this sample)

AgentTesla

Executable exe 9b04212fb1aeea566fe8268a73e7449addf9fc0c09dbebec6fae9cebae9834c3

  
Dropping
MD5 080f2be3c33dc4bd8e9346378426deee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b04212fb1aeea566fe8268a73e7449addf9fc0c09dbebec6fae9cebae9834c3

Comments