MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7aa02d07edfd0c1a75eb3f05694c8fb0955fd4c654fa1a7a97f01e736a3cccb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7aa02d07edfd0c1a75eb3f05694c8fb0955fd4c654fa1a7a97f01e736a3cccb5
SHA3-384 hash: b646fdb69c550c05e3d1cec3d1ca8087cc7c1dd3f3617ae588c13e41c314b7d2a571b36b1e6fb7dc041caaf7b7d27382
SHA1 hash: 9f018b2dd4a4a373d808b4a4c689160c66e551e6
MD5 hash: 6a23fcee27c15c8a5e7f6225c20d76dd
humanhash: winner-sad-black-charlie
File name:T. HALK BANKASI A.S.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:252'825 bytes
First seen:2020-07-09 12:13:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:dbHzSG5t8qi+ZDvjhDI3d6FIly6Lz9eE9Pz:JH2+xRMU2kH8L
TLSH 4D3423A7B4942F2B848D887362EB45CADBF03571D8F6B56279D5D6C46EB9E70E000388
Reporter abuse_ch
Tags:AgentTesla geo Halkbank TUR zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: halkbank.com.tr
Sending IP: 103.216.126.7
From: HALKBANK.E-EKSTRE@halkbank.com.tr
Reply-To: HALKBANK.E-EKSTRE@halkbank.com.tr
Subject: T.HALK BANKASI A.S. 09.07.2020 Hesap Ekstresi
Attachment: T. HALK BANKASI A.S.zip (contains "T. HALK BANKASI A.S.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WTA.20717.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7aa02d07edfd0c1a75eb3f05694c8fb0955fd4c654fa1a7a97f01e736a3cccb5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 12:15:07 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkqc2b7n7ugbu5plh4cwstepwckv7vggkt5bu6ux6aphg2r4zs2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7aa02d07edfd0c1a75eb3f05694c8fb0955fd4c654fa1a7a97f01e736a3cccb5

(this sample)

AgentTesla

Executable exe d95da3b2e36df903e14aab07df9dfbc266028bd4d110d8607d10f06aa927cb75

  
Dropping
MD5 9a93aae886b13bfa86dade71e0b21846
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d95da3b2e36df903e14aab07df9dfbc266028bd4d110d8607d10f06aa927cb75

Comments