MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b1ce4d08b8f3fd18892df0085bb2413f5421a3bc7dfd8b758ffb48422f6ed51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b1ce4d08b8f3fd18892df0085bb2413f5421a3bc7dfd8b758ffb48422f6ed51
SHA3-384 hash: 4b560fc382ab85e74e1dd232386c3fdbb1c032689e7bf3644e6ff9cd14a55a67776888375ce9a6faa1c12a1806a3b478
SHA1 hash: ee862540ee94ee887e95dc0c07e5b7ed65418a3d
MD5 hash: d7d4f1bb1c3b40a6197c154784247a1b
humanhash: michigan-social-triple-zulu
File name:Quotation.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:380'391 bytes
First seen:2020-06-28 09:11:48 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:I+ClsyVq0X67heKHTwLwGams8OW5hDD+HsFfLQ0FUBA6yBQcQfIY212uaSwMcQzp:IwywJhGa3W73sgfLety4f+cuhwL64e80
TLSH 958423CB15C9AB6D1C439A243943A367C8346550869F5DFF8B08DAFE8C7C52CC3B9658
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mmail.takproducts.co.th
Sending IP: 111.223.53.82
From: Amirali Abdolvand <narumon@takproducts.co.th>
Subject: Quotation/Order 2828-5 spring
Attachment: Quotation.arj (contains "Quotation.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b1ce4d08b8f3fd18892df0085bb2413f5421a3bc7dfd8b758ffb48422f6ed51/
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2020-06-28 09:13:04 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmoojuelr475dces34ailozecp2uegr3y7p5rn2y762iiixw5viq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 4b1ce4d08b8f3fd18892df0085bb2413f5421a3bc7dfd8b758ffb48422f6ed51

(this sample)

AgentTesla

Executable exe 7a477a446769be5e8f006df9f0b2a77439d269acca020f44954ec93a98252164

  
Dropping
MD5 8dd47033785a86db3ffa9209acb1bc04
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a477a446769be5e8f006df9f0b2a77439d269acca020f44954ec93a98252164

Comments