MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 632c3fe11f45cb5b43377439f3dbe5c2f2ee0694aeb471e02fcddc6d489998dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 632c3fe11f45cb5b43377439f3dbe5c2f2ee0694aeb471e02fcddc6d489998dc
SHA3-384 hash: 206cd8289569ab6c8ecaebf4f2fa0dee178b65ad27578e28f70a1ff1c5f2b08291458979b4730451290ab3e673653972
SHA1 hash: 0dcc5bc3506bc1658a6043a072a72cdf72b77b2c
MD5 hash: d1d3e0eabe9af65cfdac9580d9deaa06
humanhash: hawaii-early-angel-single
File name:HALKBANK.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'621 bytes
First seen:2020-05-13 07:10:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:QDKZ50NE5ADMo+I1p3KQkRaU/N5mzCIgbr:z5QUADMzO3xbUDmz1Sr
TLSH D794234215608A3B313A53EC33EBAB4B8F9A3D8517CB8B1D4873531B03E6E9549C4ED6
Reporter abuse_ch
Tags:AgentTesla geo Halkbank TUR zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: halkbank.com.tr
Sending IP: 212.114.52.149
From: T. HALK BANKASI<EKSTRE@halkbank.com.tr>
Reply-To: T. HALK BANKASI<EKSTRE@halkbank.com.tr>
Subject: T.HALK BANKASI A.S. 13.05.2020 Hesap Ekstresi
Attachment: HALKBANK.zip (contains "HALKBANK.exe")

AgentTesla SMTP exfil server:
mail.doris.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 07:36:51 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mmwd7yi7ixfvwqzxoq47hw7fylzo4buuv22hdybpzxog2seztdoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 632c3fe11f45cb5b43377439f3dbe5c2f2ee0694aeb471e02fcddc6d489998dc

(this sample)

AgentTesla

Executable exe 6f44c94e9201a9772007bd4f6e643f0a222b9a176beaa4365204f53c77a92939

  
Dropping
MD5 8f34827203057bd164aa4bc321273b97
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f44c94e9201a9772007bd4f6e643f0a222b9a176beaa4365204f53c77a92939

Comments