MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b51473aa4a924afa24f4632cbae1fb5710d593b9b26328d0f9fb5f7304165a9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b51473aa4a924afa24f4632cbae1fb5710d593b9b26328d0f9fb5f7304165a9d
SHA3-384 hash: 70acaccc2e1c3ffc91e3ca8158b7d2607a17b4a68f9cc93dbc7c66c9bb2f69c978d6cd4d23791872ff6bbfa30b767496
SHA1 hash: f5461d5120a25af6d7ea64160c9532f35f400076
MD5 hash: 12ec1882cb28bc691a381c3ad5e96e01
humanhash: bacon-item-single-xray
File name:Shipment details - IVC04 Kibbled - SO 805651.pdf.001
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'846 bytes
First seen:2020-05-26 12:58:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:pUd+0u45NkJWjd53bebJjgWxYJzMaoi560pforfSfPXfS78YgmxqYfUT3r+GL:pUdLQcz3qbJ8fJoRiot4PXf6fqtrFL
TLSH 7294234504F88D0B6C8BCB6ED7FD9ECF8A02A6253E31C214A73DC9A96660165F1D125F
Reporter abuse_ch
Tags:001 AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: starpole.com
Sending IP: 209.58.149.76
From: Amani Al Danaf <arnaud@starpole.com>
Subject: Shipment details - IVC04 Kibbled - SO 805651
Attachment: Shipment details - IVC04 Kibbled - SO 805651.pdf.001 (contains "Shipment details - IVC04 Kibbled - SO 805651.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 13:36:31 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b51473aa4a924afa24f4632cbae1fb5710d593b9b26328d0f9fb5f7304165a9d

(this sample)

AgentTesla

Executable exe baaf2981e64ed0745b71f49dc599ece70213ac2f805d8d1a4f254f9bb3fcc5cc

  
Dropping
MD5 f74dd1f40ede7e6783a8ccddb00d5432
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 baaf2981e64ed0745b71f49dc599ece70213ac2f805d8d1a4f254f9bb3fcc5cc

Comments