MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eeff507400372a416a8115c24438df82c39d7e500582e8c978b4ce729f8bb9ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eeff507400372a416a8115c24438df82c39d7e500582e8c978b4ce729f8bb9ca
SHA3-384 hash: 5acbaed3c2ae4ebba077d2808e2c446cff41d185783feeb4da9bfef0210401b286327ed5580e665e41a308c6310bfc12
SHA1 hash: 5f385724acf8918ff12de511051be6f923167de6
MD5 hash: 5ff0931e7415967430c614f884442eb7
humanhash: jersey-butter-summer-blossom
File name:MV_NAVIOSRAY.pdf.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:534'942 bytes
First seen:2020-07-29 11:11:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:NUgecT/mpriUmZFnqxPRfSH9tuxk8RVOnn/QXfyTfzC7qY:MlpraZFnqRRy9tuxxQQXfyr0v
TLSH 35B423F46FE7885EE997E87810BEF138A7F2DE2AF0718845C29A44CB3769101CDB1542
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: toi27.localdomain
Sending IP: 45.127.62.50
From: Wayde Wang (Mr) <kiehn@cam.com>
Subject: Re: 回复: agent nomination/fangcheng//20I-VC-BN47//MV NAVIOS RAY V01
Attachment: MV_NAVIOSRAY.pdf.arj (contains "MV_NAVIOSRAYpdf.exe")

AgentTesla SMTP exfil server:
secure231.servconfig.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eeff507400372a416a8115c24438df82c39d7e500582e8c978b4ce729f8bb9ca/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:13:04 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=537va5aag4vec2ubcxbeiog7qlbz27sqawborslywthhfh4lxhfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eeff507400372a416a8115c24438df82c39d7e500582e8c978b4ce729f8bb9ca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip eeff507400372a416a8115c24438df82c39d7e500582e8c978b4ce729f8bb9ca

(this sample)

AgentTesla

Executable exe 16b640035421f4d02280a93e7eb442c0a6e933b34eb56b7a65365b154cbe7dbe

  
Dropping
MD5 e80127d7e94474e0e5d135066872ea81
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 16b640035421f4d02280a93e7eb442c0a6e933b34eb56b7a65365b154cbe7dbe

Comments