MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eeb4319818959c111beae9f0bd038991b41a9294c50700c6390ce9fe5490fb74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eeb4319818959c111beae9f0bd038991b41a9294c50700c6390ce9fe5490fb74
SHA3-384 hash: b6bd04414564afb71e16de71604916daf66615157eb278e26b3691099d14f6b04629610df671970a04335b74e3e00c3a
SHA1 hash: 5396ef0eb79dc941602e6fc7cdd8055119ba0099
MD5 hash: 8744c132c480a768be02b78b7578d88d
humanhash: whiskey-foxtrot-paris-jersey
File name:Payment Copy.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'289 bytes
First seen:2020-05-27 18:10:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:c+8Yz61OmnvDU+zS5z0tXQDijah4STkgNFxiOCFxQng3crSbi9lZ/Zp:BGOmnI+zS5gtgDieh4SAgBi9knXP9lzp
TLSH 59942349E5E1748ACB0100F27CF4C936EFFA4D1669C29A6E578E0F810DA6363BC51F95
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp5.intred.it
Sending IP: 62.97.32.61
From: Gina (Gina) Breedt <eugenio.braghini@intred.net>
Reply-To: sanpoyan@staff.hkbu.edu.hk
Subject: Confirm the payment copy
Attachment: Payment Copy.rar (contains "Payment Copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.Bredo-AIC.23964.27425.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 18:37:50 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar eeb4319818959c111beae9f0bd038991b41a9294c50700c6390ce9fe5490fb74

(this sample)

AgentTesla

Executable exe 637b72e82538b767707282db37c0f960aa60c72e3c44c76ecaf232a9c105bf41

  
Dropping
MD5 6ad7d8bf86c04715891b54cd2fe4a3de
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 637b72e82538b767707282db37c0f960aa60c72e3c44c76ecaf232a9c105bf41

Comments