MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eba6d9611f65cb19b64adaed2b186ae179de6807698a0215468c297db1993010. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eba6d9611f65cb19b64adaed2b186ae179de6807698a0215468c297db1993010
SHA3-384 hash: e8f56c6309b8235f6d9dfa9c354a034ea27c67cde2713c823ea799ed3d0fb88087caa3dee976439572f92aea0597ac05
SHA1 hash: a6a8b4dee03b0fb00bff8417357694e9649ea8e1
MD5 hash: bab835b04aa846bb7a637f0c470f09c5
humanhash: high-kitten-eighteen-music
File name:Proforma inv. KI2010-2926.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:371'437 bytes
First seen:2020-10-15 05:05:14 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:udvJZEoELQiSt15S5qzGJ29COoad4iamDHLYZ0y53s7yaBr3CKD:kvHGSHI55J2ClaaQr+ztexryu
TLSH C58423FDAEEB019994B3A7D1B05E35358A89C990C48557FAF0AFC4503533EE7812E392
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Fernandes, Marina <marina.fernandes@ferro.com>"
Received: "from ferro.com (unknown [95.211.217.177]) "
Date: "14 Oct 2020 12:54:39 -0700"
Subject: "RE: PO Oct 2020"
Attachment: "Proforma inv. KI2010-2926.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eba6d9611f65cb19b64adaed2b186ae179de6807698a0215468c297db1993010/
Threat name:
Win32.Spyware.OutBreak
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 20:21:05 UTC
File Type:
Binary (Archive)
Extracted files:
62
AV detection:
21 of 29 (72.41%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5otnsyi7mxfrtnsk3lwswgdk4f4542ahngfaefkgrqux3mmzgaia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/eba6d9611f65cb19b64adaed2b186ae179de6807698a0215468c297db1993010

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz eba6d9611f65cb19b64adaed2b186ae179de6807698a0215468c297db1993010

(this sample)

AgentTesla

Executable exe 80a7c8c7cd8594cd104373030b31403f6d076c0529b87c63f06da0f53dd6605b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80a7c8c7cd8594cd104373030b31403f6d076c0529b87c63f06da0f53dd6605b
  
Dropping
AgentTesla

Comments