MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efaeed250eea50519ef088771fce1765d2c0a489e1b2642ede06f18cc781dc51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efaeed250eea50519ef088771fce1765d2c0a489e1b2642ede06f18cc781dc51
SHA3-384 hash: feefb086d00be7fec0c8623650a221b2704a5c1c4d4acbad4c8a2d5e8a90b6512569ecc474e50d479ac84b64ae51a5f0
SHA1 hash: c6ea8f49b1d819451a7d3b56ae58a1f6b8c38dd7
MD5 hash: 58096140992b4c2180250760a18289a4
humanhash: juliet-delta-chicken-jupiter
File name:DEBIT NOTE USD 5.412.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:537'920 bytes
First seen:2020-08-12 14:40:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:KL1Wy9cKbTBxNwKh7Awa2WDuQ2lnJfR+oXBfRQ22OlIzJkliPh3IU:KLAy9cqTBnwKJAwwKQafBZQDOl8Jklwr
TLSH 74B423D33CA60C523C658DF807A7B24C4E5AD1F684EA829FDB412455CC1E764BAA6FF0
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: derinfikirler.com.tr
Sending IP: 89.252.162.43
From: Michele <info@ronay.com.tr>
Subject: REFERENCE NOTE- LAST SHIPMENT
Attachment: DEBIT NOTE USD 5.412.rar (contains "DEBIT NOTE USD 5.412.exe")

AgentTesla SMTP exfil server:
mail.elsiekitchen.com.sg:587

AgentTesla SMTP exfil email address:
ginxu100@yandex.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/efaeed250eea50519ef088771fce1765d2c0a489e1b2642ede06f18cc781dc51/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 14:42:07 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=56xo2jio5jifdhxqrb3r7tqxmxjmbjej4gzgilw6a3yyzr4b3riq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/efaeed250eea50519ef088771fce1765d2c0a489e1b2642ede06f18cc781dc51

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar efaeed250eea50519ef088771fce1765d2c0a489e1b2642ede06f18cc781dc51

(this sample)

AgentTesla

Executable exe 7013e2ac13e42bbee07bb06c5f9c2e4b625a6599a64bccf0e844ba2e995e0737

  
Dropping
MD5 558f65b17e6064c2e2df1a5aa2e0795b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7013e2ac13e42bbee07bb06c5f9c2e4b625a6599a64bccf0e844ba2e995e0737

Comments