MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebf649139f5bd13eeeb62fd9c6dcae4a28c218388067938718fc7eb75d021426. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebf649139f5bd13eeeb62fd9c6dcae4a28c218388067938718fc7eb75d021426
SHA3-384 hash: 95f7f195664a31b5b61fd909f650fe94afe93ece000999e3919504f03adc18adfd1740691a0e4e330451f90902327d77
SHA1 hash: 467e115e3c6d7fa664552798f30a3636e9283d83
MD5 hash: 263f50c0b35f1d8436539e6b569a499e
humanhash: juliet-friend-echo-equal
File name:Packing List.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:499'701 bytes
First seen:2020-08-06 05:23:13 UTC
Last seen:2020-08-06 14:54:37 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:1Pm7Pp0aAIghaFuywW/Gk+vbvPHA3lz8JhlgxLaXwc+:QjM/yd/G9PHkzqwLkwc+
TLSH 10B42319C781061924BB1F08C6E2759302A17668FFC996F2BF1E71DE29757E2C6EC243
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: egdistriselecta.com
Sending IP: 37.48.85.246
From: Sales Department<Anita@egdistriselecta.com>
Subject: Re: attached Packing List
Attachment: Packing List.pdf.z (contains "Packing List.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ebf649139f5bd13eeeb62fd9c6dcae4a28c218388067938718fc7eb75d021426/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:25:06 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5p3ese47lpit53vwf7m4nxfojiumegbyqbtzhbyy7r7loxiccqta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ebf649139f5bd13eeeb62fd9c6dcae4a28c218388067938718fc7eb75d021426

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z ebf649139f5bd13eeeb62fd9c6dcae4a28c218388067938718fc7eb75d021426

(this sample)

AgentTesla

Executable exe d99680b269d345d0e78e80b5310077f35e781ab5e74a1f926cb0be47d185a9c4

  
Dropping
MD5 aaf4e659d4938d1173348105650d7755
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d99680b269d345d0e78e80b5310077f35e781ab5e74a1f926cb0be47d185a9c4

Comments