MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d2dabc9624838a0c811566ca006ebe1a66bedf34e76c077d93dbf05794c7b15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d2dabc9624838a0c811566ca006ebe1a66bedf34e76c077d93dbf05794c7b15
SHA3-384 hash: b735235ec9ad4334ccee10aeb9bc3fc73832d877a8b405fe46249cf065635e11f2cb4dd38be712392727be37c4f95662
SHA1 hash: 7633f8231ee9f10543ce07103ed1a0aafd70fc11
MD5 hash: 47bdf4e19b77fafba6fd121b80cc00f5
humanhash: saturn-freddie-helium-angel
File name:Hesap Özeti Bildirimi-Tarih 17.06.2 020.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:223'249 bytes
First seen:2020-06-17 11:44:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:2zT70emKFscpbHphLtiGpZlhqBQoHY8JoVOyL3O:KT7dmCHxXZlGQohJov3O
TLSH 052423367C888B19115CEE374A4F6272392CC12FBBECA24ED1709B85593476BD03896F
Reporter abuse_ch
Tags:AgentTesla geo TUR z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.etrade.kiev.ua
Sending IP: 185.203.241.24
From: Türkiye İş Bankası <bilgilendirme@ileti.isbank.com.tr>
Reply-To: noreply@ileti.isbank.com.tr
Subject: Hesap Özeti Bildirimi-Tarih: 17.06.2020
Attachment: Hesap Özeti Bildirimi-Tarih 17.06.2 020.z (contains "Hesap Özeti Bildirimi-Tarih 17.06.2 020.exe")

AgentTesla SMTP exfil server:
mail.ereglitso.org.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheFihaB.28739.27853.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 12:35:48 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=huw2xslcja4kbsarkzwkabxl4gtgx3ptjz3ma56zhw7qk6kmpmkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3d2dabc9624838a0c811566ca006ebe1a66bedf34e76c077d93dbf05794c7b15

(this sample)

AgentTesla

Executable exe cb4da13a159f505b6ac0fe452d61fdf95952ff5e26a5d6bb97b4bd6ce9dbfc00

  
Dropping
MD5 83f47fb4085fd6ef0cb55ef255b43348
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb4da13a159f505b6ac0fe452d61fdf95952ff5e26a5d6bb97b4bd6ce9dbfc00

Comments