MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebd56e2b5cc76acc073c9f7821ca7d891ec41f5db09d7ef7febb0eacef5cb921. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebd56e2b5cc76acc073c9f7821ca7d891ec41f5db09d7ef7febb0eacef5cb921
SHA3-384 hash: 30a42ce32dc11051bea4d3e5e27b9a258ed2be7505b91e40da428cb833dd5ffaffc49d56b65810515f9c4bcff6bbfac5
SHA1 hash: 3a58720a529205f5ad145fbef893544a99d59b3a
MD5 hash: f5a7040941cc75d3a5358b32194e652b
humanhash: fish-seventeen-eighteen-social
File name:paid invoice slip.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'638'400 bytes
First seen:2020-06-29 12:45:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:SjnGLjIup+Q67pPhPc3IAMXOvIHoFdDRVmqOJ1UVSP7KIlpk1TEh8hd0+TgI6:SjoUuGNhPc3uOIoScVSzKIAEh2uh
TLSH 6F758D22F2924433E1F296389D1B53B5983ABE133D3858467BE5CD6C5F3968338352A7
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alkuhaimi.com
Sending IP: 209.58.149.71
From: Accounts Department <rud-division@alkuhaimi.com>
Subject: paid invoice
Attachment: paid invoice slip.IMG (contains "IMG COPY SCAN PO PROPOSAL 43234432.exe")

AgentTesla SMTP exfil server:
mail.urf-br.com:587

AgentTesla SMTP exfil email address:
portweaver61@gmail.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebd56e2b5cc76acc073c9f7821ca7d891ec41f5db09d7ef7febb0eacef5cb921/
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 12:47:05 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5pkw4k24y5vmybz4t54cdst5repmih25wcox5576xmhkz324xeqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ebd56e2b5cc76acc073c9f7821ca7d891ec41f5db09d7ef7febb0eacef5cb921

(this sample)

AgentTesla

Executable exe 94e6a8e8c811f7ce427d1f77f9dd966b851d8a3433a2fb4e82271ef7d364e8de

  
Dropping
MD5 d7f28743727da9d3cc6b378284effa16
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94e6a8e8c811f7ce427d1f77f9dd966b851d8a3433a2fb4e82271ef7d364e8de

Comments