MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eab82ea11de4993fea8e345fb87597592121fdb60f73c6d578b37b712364cfd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eab82ea11de4993fea8e345fb87597592121fdb60f73c6d578b37b712364cfd4
SHA3-384 hash: 36e209bc17cfe2bded61db8bfd3940eba2e8ca09a8823d54200304e8c88964e2f8743cbaf64e09ab025a024e36097ce1
SHA1 hash: 5b6a29ca5528da250c80554f4162d1d1c76cf73d
MD5 hash: b87ff657bde3255d3eeac26e7f2f11c1
humanhash: mango-aspen-ceiling-nitrogen
File name:Client Balance Payment For May 2020.Pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'251 bytes
First seen:2020-06-15 12:40:42 UTC
Last seen:2020-06-15 16:15:38 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:3P+dkila3Qs5etBukSXB3aNwqCmyjjXQBMHlGgQbsj2:QHa3kB8dI+jDQBMHEg9j2
TLSH 099423DF6400FD71FDE0597866581331CD63EF9A8B82E8E09685D221E49E809C5BBC6D
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: groupalrayes.com
Sending IP: 192.227.246.82
From: Roy Bernard <accounts3eqpt@groupalrayes.com>
Subject: Sharedfile for Last May 2020 Payment
Attachment: Client Balance Payment For May 2020.Pdf.gz (contains "Client Balance Payment For May 2020.exe")

AgentTesla SMTP exfil server:
mail.almushrefcoop.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:42:07 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5k4c5ii54smt72uogrp3q5mxleqsd7nwb5z4nvlywn5xci3ez7ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz eab82ea11de4993fea8e345fb87597592121fdb60f73c6d578b37b712364cfd4

(this sample)

AgentTesla

Executable exe e7d122486a566fba3c38b1b542c77d33550c62e82e51d1cfac21d08c9eac4a33

  
Dropping
MD5 c6603658b741087d4102daf507299972
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e7d122486a566fba3c38b1b542c77d33550c62e82e51d1cfac21d08c9eac4a33

Comments