MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 511911c49fabf8c4744bfb6d9f3003d23583f3e153ed34ebff332d455beaa8a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 511911c49fabf8c4744bfb6d9f3003d23583f3e153ed34ebff332d455beaa8a7
SHA3-384 hash: f5ec73988856e06088f5d74fa09f1adf5068a51dd0ff7163830e30fa4db899dea90a4c45df8dc69e01e28ba4385fa7a1
SHA1 hash: 2b9b2471a446c2a5e054b7ed6fd17daac765e9bb
MD5 hash: 5b64fe86bc33211f473983d4616566e3
humanhash: muppet-sweet-sierra-bravo
File name:cotización.PDF________________________.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'103 bytes
First seen:2020-08-14 15:20:39 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:23/sLGk5jSbK5VOFSR+Q6uLLqCh7mDnf+nfRyLpzUxP5808ot0OiX:rGamb4PR+uLNh7mf+noLWR5vtbiX
TLSH 4A94234CCD1A7C29DDAC992584675F6B780A6014EB6EDBFF9E2485AC4AE4C0C35F0EC4
Reporter abuse_ch
Tags:AgentTesla ESP geo gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: centrohidraulico.com.ar
Sending IP: 45.137.22.118
From: Maria Emilia Lopez - Centro Hidraulico S.A <me.lopez@centrohidraulico.com.ar>
Subject: RE: Nueva consulta / orden de cotización
Attachment: cotización.PDF________________________.gz (contains "cotización.PDF________________________.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27554.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/511911c49fabf8c4744bfb6d9f3003d23583f3e153ed34ebff332d455beaa8a7/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 15:22:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kemrdre7vp4mi5cl7nwz6mad2i2yh47bkpwtj277gmwukw7kvctq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/511911c49fabf8c4744bfb6d9f3003d23583f3e153ed34ebff332d455beaa8a7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 511911c49fabf8c4744bfb6d9f3003d23583f3e153ed34ebff332d455beaa8a7

(this sample)

AgentTesla

Executable exe e1cc292b3eb8e646e0c778966a3150d2f278e1394059cf31106301bb003d273f

  
Dropping
MD5 e73d435515fa8765d7a2992758ad2ef9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1cc292b3eb8e646e0c778966a3150d2f278e1394059cf31106301bb003d273f

Comments