MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51f99a267b65b6a88cdeb64e3d8bfe65f9c1bdcc3e52a40ee4f2bbbdbcf9b5d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51f99a267b65b6a88cdeb64e3d8bfe65f9c1bdcc3e52a40ee4f2bbbdbcf9b5d0
SHA3-384 hash: 5d568659c224e5060d5c7bd854b817cd856631d5c0a6bae7fda68597e017623b0e411485d2c33d286df6b87de8c968df
SHA1 hash: bdb58a9cf17b68e508c51677a85166a89e1866b3
MD5 hash: 6896a57e7f992e90e427697f9cb2421d
humanhash: berlin-may-mobile-december
File name:Order 1391914.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:465'169 bytes
First seen:2020-07-22 06:13:32 UTC
Last seen:2020-07-24 00:53:28 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:UI6ZZknySoitcoqf0ZeWMLAFpCpgK7HxfNb:Utw2iSBc9BF8ptHxh
TLSH 45A423B20A7DB6E4D7856AC3078AA692154C8D9DF1F27C7CAC20E6077FBB194C15704E
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vm86.entorno.es
Sending IP: 195.162.18.193
From: Sales Coordinator<info@ampsprayers.com>
Subject: Purchase Acknowledgement PO# PO_009237-1 -- Order# 1391914
Attachment: Order 1391914.pdf.z (contains "Order# 1391914.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51f99a267b65b6a88cdeb64e3d8bfe65f9c1bdcc3e52a40ee4f2bbbdbcf9b5d0/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 06:15:07 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kh4zujt3mw3krdg6wzhd3c76mx44dpomhzjkidxe6k533phzwxia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51f99a267b65b6a88cdeb64e3d8bfe65f9c1bdcc3e52a40ee4f2bbbdbcf9b5d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 51f99a267b65b6a88cdeb64e3d8bfe65f9c1bdcc3e52a40ee4f2bbbdbcf9b5d0

(this sample)

AgentTesla

Executable exe b4c84cf915c0f29a82c0fa8d9e7c7940338ebedf458ce7d4b187935bd5ba9e82

  
Dropping
MD5 c2a67ac35ee618dca130790dd9ae2d3b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4c84cf915c0f29a82c0fa8d9e7c7940338ebedf458ce7d4b187935bd5ba9e82

Comments