MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b51e1667e44d9e800de5afe9c27ae818a3c6563eddc33152a4bd029905ec9e33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b51e1667e44d9e800de5afe9c27ae818a3c6563eddc33152a4bd029905ec9e33
SHA3-384 hash: 2931fcd8a96f947e3e30d16b0f2bc35fe0ab2cf78b82fcb178e6b3902f3a96f2fde9fdfbfff66909a9740067942d75a7
SHA1 hash: 858bab0f589c3733ea9b887dfc028363c37e6706
MD5 hash: 9c97b022d7ea52d94f135f09e65ed444
humanhash: july-undress-kentucky-single
File name:DHL.INFORMATION.TRACKING.PDF.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:589'984 bytes
First seen:2021-03-10 16:57:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xOdS8/z6M015t/Xgs3jyorzjh2r+NRRbhmJJHEEbacdi6T/KU9b4W3lB:xla9Kn4YpLh2r83wJpEEXjTiLqlB
TLSH CBC423E6F3B5E098541C90D483BFA717E2C43B1A1E227E4EB964CC5119F1CA4B8617CB
Reporter abuse_ch
Tags:7z AgentTesla DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bosmailout05.eigbox.net
Sending IP: 66.96.190.5
From: DHL Express Notification<sales@carlinkmotors.com>
Reply-To: officeme47@yandex.com
Subject: DHL Arrival Notification
Attachment: DHL.INFORMATION.TRACKING.PDF.7z (contains "DHL.INFORMATION.TRACKING.exe")

AgentTesla SMTP exfil server:
web2.changeip.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 16:58:09 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wupbmz7ejwpiadpfv7u4e6xidcr4mvr63xbtcuvexubjsbpmtyzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/b51e1667e44d9e800de5afe9c27ae818a3c6563eddc33152a4bd029905ec9e33

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b51e1667e44d9e800de5afe9c27ae818a3c6563eddc33152a4bd029905ec9e33

(this sample)

AgentTesla

Executable exe 2fa362acbc27f359e1888193ebded0602d198f3f465010f91ed590bfa755f116

  
Dropping
MD5 2540bd36cc644b2c017b5665532b9f60
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2fa362acbc27f359e1888193ebded0602d198f3f465010f91ed590bfa755f116

Comments