MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebae986d1f9d48d304565639f59cb7714ce893b008d1c59eaa2c56ec1f3309b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ebae986d1f9d48d304565639f59cb7714ce893b008d1c59eaa2c56ec1f3309b7
SHA3-384 hash: 06969f367e8e1e75592080c399f14d471606d8bf55f222d92e1c5093cc948538b447122a42efb6f5e53184dbd6133624
SHA1 hash: 63ff47f72bf6ce13c4dc6f728b038baf8b61e74c
MD5 hash: e31f2a2e5b1b97e9050c5d2851aab084
humanhash: oven-montana-angel-pennsylvania
File name:zEfrT4S4aA4n.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:436'527 bytes
First seen:2020-05-27 07:44:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:TJTEGhm27WHPKsK1cnmhcR6ABkQQap528SJohT8b:TJgGhMX1ecR6ABKap5wmhYb
TLSH E894237EDB857910CD93E7285E2345366CA2CD2E432CADEB26D211B8E6DE64D140E7B0
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mono.avnam.net
Sending IP: 190.210.186.210
From: SHF Trading Co.,Ltd <sales@atagroupuk.com>
Subject: Verificar Fatura
Attachment: zEfrT4S4aA4n.pdf.z (contains "zEfrT4S4aA4nfGf.exe")

AgentTesla SMTP exfil server:
mail.dehydratedoniongarlic.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheFihaB.30766.16228.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 09:13:26 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
13 of 48 (27.08%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ebae986d1f9d48d304565639f59cb7714ce893b008d1c59eaa2c56ec1f3309b7

(this sample)

AgentTesla

Executable exe e6f64ebfe192916b6549167c5ad86abf075ee61f2a587c32bb3061cde52f04da

  
Dropping
MD5 238bf6a383f02041601ee2fc02a0d902
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6f64ebfe192916b6549167c5ad86abf075ee61f2a587c32bb3061cde52f04da

Comments