MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67d873a2f758712fdd468d631a19f867503b6a2e2f0b4be5d21ab27cd7e65bd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67d873a2f758712fdd468d631a19f867503b6a2e2f0b4be5d21ab27cd7e65bd2
SHA3-384 hash: ded3d9ae21bc6dbd12f87139fcedf054143c349f49afded1e2a23ab96fd1f4db8112e8d8052b634a8be355115e29a8c1
SHA1 hash: 6652456728cb816d9c0c9d2b752175aab45d4a0a
MD5 hash: 994bd99f73f2a9a7a90a2689c4efd70d
humanhash: november-utah-orange-sad
File name:DEKONT PDF.bz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:405'450 bytes
First seen:2020-05-08 08:51:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:HYIi+M29jiAH5kd3aa/4bHLNUVGwVtIxgJoWw7YV:HYIi+N5gqaAtUVGwVtIxBWtV
TLSH 708423151A143EA444FEDB448C6E638F6B2C5DCD1A928EB0B3DE664AC51EF107E8BD1C
Reporter abuse_ch
Tags:AgentTesla bz geo Halkbank TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.hamdikucuk.com.tr
Sending IP: 176.236.52.186
From: Halkbank Internet Subesi i <internet.subesi@halkbank.com.tr>
Reply-To: ZIRAAT internet.subesi@halkbank.com.tr@mail.hamdikucuk.com.tr
Subject: 08.05.2020 TARİHLİ DEKONT
Attachment: DEKONT PDF.bz (contains "crypted.exe")

AgentTesla SMTP exfil server:
mail.mkkarakosemobilya.com:587

AgentTesla SMTP exfil email address:
mahmut@mkkarakosemobilya.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 09:36:01 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m7mhhixxlbys7xkgrvrrugpym5idw2rof4fuxzosdkzhzv7glpja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 67d873a2f758712fdd468d631a19f867503b6a2e2f0b4be5d21ab27cd7e65bd2

(this sample)

AgentTesla

Executable exe ef0e3fa0b391bdc3f8a6314ba3ca48cda4cea5a8e8e75f81681d70eaf4f3e39b

  
Dropping
MD5 e3d02f8f674ee70cbb888c94f6f67d14
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ef0e3fa0b391bdc3f8a6314ba3ca48cda4cea5a8e8e75f81681d70eaf4f3e39b

Comments