MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41e665a068bc5b40e1bb751273a47083415aa31a4faeb1a29b5766f207334d7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41e665a068bc5b40e1bb751273a47083415aa31a4faeb1a29b5766f207334d7b
SHA3-384 hash: 30b4b78e8d22f0a0e987d8e8a49856efc0a8833589c74679e28153cc084d3bb41b62c488187bee6fb8a85c9a30b1645b
SHA1 hash: 2ff64a30391d68b2dc55a3bafaf9097c3abe37d2
MD5 hash: 74a2f75a1eb709c9f5b9597591219e4f
humanhash: pasta-bluebird-friend-harry
File name:Halkbank_Estre_20200520_98764836438_7384638734.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'574'816 bytes
First seen:2020-05-20 06:48:41 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:knkaDnfIHqdM+vYOZO4v0pQ9/+D8LdxbR32I8+iDjIG5MSWULluU/kd/BTMcymj:kkKwSvBH8Se8vIs2/luVd/pMcjj
TLSH 4B7533653949D6762B0700ADE75E9D421E1652840E2BEEF824BE9F3F95383103B2DE4F
Reporter abuse_ch
Tags:AgentTesla geo Halkbank r00 TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: halkbank.com.tr
Sending IP: 156.96.58.98
From: HALKBANK.E-EKSTRE@halkbank.com.tr
Subject: T.HALK BANKASI A.S. 18.05.2020 -201.05.2020 Hesap Ekstresi
Attachment: Halkbank_Estre_20200520_98764836438_7384638734.r00 (contains "Halkbank_Estre_20200520_98764836438_7384638734.exe")

AgentTesla SMTP exfil server:
mail.brightpackaging.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 07:36:33 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihtglidixrnubyn3oujhhjdqqnavviy2j6xldiu3k5tpebztjv5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 41e665a068bc5b40e1bb751273a47083415aa31a4faeb1a29b5766f207334d7b

(this sample)

AgentTesla

Executable exe 86d92b062ff4d135ef51a7444cfb14aa86b5fcfa78f7916e2cc514b8a055ca54

  
Dropping
MD5 94e04760095e0288680b809f23c1149c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 86d92b062ff4d135ef51a7444cfb14aa86b5fcfa78f7916e2cc514b8a055ca54

Comments