MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35a576cd45aff62ba443773613520c45409e9e859bed405b6e24a6aa2d6f1883. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35a576cd45aff62ba443773613520c45409e9e859bed405b6e24a6aa2d6f1883
SHA3-384 hash: b79afd8076e6a010c825df92afd0cb3ff47d2f5f665c6eb78ee3c207f9a5ad049594defb9aa06a1cb827e0a4c96b3248
SHA1 hash: 70145773e929c8867b220ac1e6e0f87f3aaa5556
MD5 hash: 0e20a6057d8251e59b082035f311f786
humanhash: burger-pennsylvania-oscar-november
File name:Ziraat Bankas1 Swift Mesaji1_20200604-4A83-4C11-A410-FDF7C81DDA9E.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'031'829 bytes
First seen:2020-06-04 14:22:22 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:ZOvqLLNu0Ic6N4HngBzw3+gBkOoa8o8eijcCpd6he:NvLBnSy/ubaOJRdse
TLSH D425336F62CE132AB61531D6F74CFA66E11C763F1C7B3DD103A4A669AC23829467C2C4
Reporter abuse_ch
Tags:AgentTesla geo r00 TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ileti.ziraatbank.com.tr
Sending IP: 156.96.45.138
From: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Subject: 50000, EUR Swift Bildirimi
Attachment: Ziraat Bankas1 Swift Mesaji1_20200604-4A83-4C11-A410-FDF7C81DDA9E.r00 (contains "Ziraat Bankas1 Swift Mesaji1_20200604-4A83-4C11-A410-FDF7C81DDA9E.exe")

AgentTesla SMTP exfil server:
mail.brightpackaging.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 14:35:58 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwsxntkfv73cxjcdo43bguqmivaj5huftpwuaw3oestkullpdcbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 35a576cd45aff62ba443773613520c45409e9e859bed405b6e24a6aa2d6f1883

(this sample)

AgentTesla

Executable exe 7e08e758f9ab52f92fb38a7d7f114ea84df6804105def422feadb8f631a6c8af

  
Dropping
MD5 0de544dd5f939e59eabffd06a71649b4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e08e758f9ab52f92fb38a7d7f114ea84df6804105def422feadb8f631a6c8af

Comments