MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3006866165ebb33ae692dc8075796e493206cf1bd2c09c5004232a89e6b982f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3006866165ebb33ae692dc8075796e493206cf1bd2c09c5004232a89e6b982f0
SHA3-384 hash: 066c61997de484dc5cf12146a1312507367c38d0495a609d57191a3f2ee500fb99fad793379a4a6df7aec0b1397f1bea
SHA1 hash: 2aef5e20e00e3b7957cdc8e2f505390577b576cf
MD5 hash: 72a77a25e6b03fddf0d00ce1b7db2e54
humanhash: summer-alaska-emma-oven
File name:T. HALK BANKASI A.S.......pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:222'378 bytes
First seen:2020-06-18 09:38:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:aSbjVpGUy7BaoIGgu3fW4E2K8sf5B1aXEhSic1Rlx:akloIGgOw8sj1aXEhsr
TLSH 6724139C1E6A3383CAC8A4FDAD19F42D7F8509C6E25963612D73BFDA17425CBC288345
Reporter abuse_ch
Tags:AgentTesla geo Halkbank TUR zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: halkbank.com.tr
Sending IP: 83.136.106.168
From: HALKBANK.E-EKSTRE@halkbank.com.tr
Reply-To: HALKBANK.E-EKSTRE@halkbank.com.tr
Subject: T.HALK BANKASI A.S. 18.06.2020 Hesap Ekstresi
Attachment: T. HALK BANKASI A.S.......pdf.zip (contains "T. HALK BANKASI A.S.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.da23c40853ae54ab.7860.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 10:37:09 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gadimylf5oztvzus3sahk6lojezanty32lajyuaeemvitzvzqlya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3006866165ebb33ae692dc8075796e493206cf1bd2c09c5004232a89e6b982f0

(this sample)

AgentTesla

Executable exe 67a4448be53c42c989e89c4b0afa01c9e7c66a5659109addcf85e2d1108b6a53

  
Dropping
MD5 da23c40853ae54abd46b7b6889c99eb7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 67a4448be53c42c989e89c4b0afa01c9e7c66a5659109addcf85e2d1108b6a53

Comments