MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebd78af7d83fff6535d76c489408e1907ea521c5a552f9501e17e81b4925e395. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebd78af7d83fff6535d76c489408e1907ea521c5a552f9501e17e81b4925e395
SHA3-384 hash: 26344f77db463428b83e3c54bc70a25873a5171074cd3fb25b22247c76fef7635cc7f1abc2fefc107f4801262ba68a0a
SHA1 hash: cc4211595f7e9751c22420e8dfc9d402c24c0275
MD5 hash: 315fbba76804eb2c9f93a836c3defdb8
humanhash: eighteen-comet-idaho-timing
File name:DMO20AGR000548TH00862.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:283'749 bytes
First seen:2020-06-04 07:29:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:do9tgAVO0DoqWGqyDB/QKPbUmOpdLrPCjPgvRWlQPiwSV++M:qbl1cqWG/QKPbUmOvj/ugi/wH
TLSH 635423C7488CFE98BDFB28DDB8D20E419C69EE9A5453493725D14FF4D7209B92B03826
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: adminls2.admingr.eu
Sending IP: 136.243.175.246
From: avorio@otenet.gr
Reply-To: avorio <c.heesakkers@tajlma-europe.com>
Subject: Fwd: RE: Παραγγελία αριθ. 12060 - ο πελάτης μου
Attachment: DMO20AGR000548TH00862.7z (contains "DMO20AGR000548TH00862.exe")

AgentTesla FTP exfil server:
ftp.rpatools10.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 07:37:40 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5plyv56yh77wknoxnrejichbsb7kkiofuvjpsua6c7ubwsjf4okq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ebd78af7d83fff6535d76c489408e1907ea521c5a552f9501e17e81b4925e395

(this sample)

AgentTesla

Executable exe 66a2878b55d41d3e576ec08bb0e28573de3af9dbbbd08567cc730198a490d021

  
Dropping
MD5 31cb45745317e6cfb53a7b26de6f0360
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66a2878b55d41d3e576ec08bb0e28573de3af9dbbbd08567cc730198a490d021

Comments