MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51701860487a1962bc8c3dfc021385afc705c9ef3a46d0949803a6e42e6efecf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51701860487a1962bc8c3dfc021385afc705c9ef3a46d0949803a6e42e6efecf
SHA3-384 hash: 5d5a2dc4e9726a5ec0e247efffde92b272cb0e3d5c5ea2e715765a558885aa17bb8dcc9a727f6c84ac0494efc81467b4
SHA1 hash: f4170b997d054e32cbc3f1be388875bde9a37658
MD5 hash: 15fa91c47c5652f74bea5e8bd9eae2ce
humanhash: bacon-skylark-tennis-oscar
File name:riveduto elenco documenti cd 2.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:468'476 bytes
First seen:2020-06-17 07:39:26 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:ugVSrW1MvbMxOHgKaCVZEifA0ae8dCpjDTjrxRBpA38T:71+bgOAKaCVZL4CpfTdYg
TLSH 38A42327F452EAD92DA947CCAD03A183EC19679D3296014B3CC709A76F67C957FE3108
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pg-italy.it
Sending IP: 5.79.121.92
From: Antonella Ferri <a.dibari@pg-italy.it>
Subject: PO-MDPO20-0088 rivisto
Attachment: riveduto elenco documenti cd 2.gz (contains "riveduto elenco documenti cd 2.exe")

AgentTesla SMTP exfil server:
smtp.dachanq.cc:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kfybqycipimwfpemhx6aee4fv7dqlspphjdnbfeyaotoilto73hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 51701860487a1962bc8c3dfc021385afc705c9ef3a46d0949803a6e42e6efecf

(this sample)

AgentTesla

Executable exe cdc3ec36fc39d013df0568b47e34265acb3da05cc313685edda8c0609ba7d325

  
Dropping
MD5 0f0a6dfd0e8d01e19e759ded54704696
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdc3ec36fc39d013df0568b47e34265acb3da05cc313685edda8c0609ba7d325

Comments