MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebe3749f3d5becb6fec267735ebf26f57901f1ad4727110f8905607322810b13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebe3749f3d5becb6fec267735ebf26f57901f1ad4727110f8905607322810b13
SHA3-384 hash: 7d09edc1e1298265797d3f6b3d5743d4dd81c6b8f0f240fa5983b3139eefe9113c5744069ddb50e8c8572ae6630e2fc8
SHA1 hash: d0ef5ad0ab9fc9fb7f7647874bbe1985784e00fa
MD5 hash: 2e4f4b3054ef799218c37f6dcf19a47b
humanhash: three-bravo-harry-ceiling
File name:Revised P.I Officina_images.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:240'168 bytes
First seen:2020-07-22 06:13:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:e5zbHYDCypP50+3JrYHscaeRiTpmbhAlKGYAD:cbupP506YHsAi1mbylKGbD
TLSH C43423E336C740FFB872DBEA50CF9157AAA4274F9732381122A7D35DB52EC251291B48
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.example.com
Sending IP: 103.147.184.169
From: Glamour Textile Mills Ltd <info@glamourtextiles.com>
Subject: FW: Revised P.I Officina 14-07-2020
Attachment: Revised P.I Officina_images.rar (contains "Revised P.I Officina_images.exe")

AgentTesla SMTP exfil server:
smtp.office365.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebe3749f3d5becb6fec267735ebf26f57901f1ad4727110f8905607322810b13/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 06:15:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5prxjhz5lpwln7wcm5zv5pzg6v4qd4nni4trcd4javqhgiubbmjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ebe3749f3d5becb6fec267735ebf26f57901f1ad4727110f8905607322810b13

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ebe3749f3d5becb6fec267735ebf26f57901f1ad4727110f8905607322810b13

(this sample)

AgentTesla

Executable exe f15d580cc1e0b17070f7fe48cb8d8a60177e4e8468d5b5f2008e6be5c3a85b42

  
Dropping
MD5 4728201d275f72fcf418bc1eb2c6faac
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f15d580cc1e0b17070f7fe48cb8d8a60177e4e8468d5b5f2008e6be5c3a85b42

Comments