MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 964626f1cbec04c4d096b5792acc31f31ba6b3de7ce00edc876fc97fcdf0086d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 964626f1cbec04c4d096b5792acc31f31ba6b3de7ce00edc876fc97fcdf0086d
SHA3-384 hash: efacd9f959033836bc534c3417483b472bf4c45ece6ab11b93bb26d3e67ae1887eeb2bb0e6f7290040c056abcbae578b
SHA1 hash: 1d279cb3be1b09f30a4b63589b30b1cb1965c44a
MD5 hash: ef75b71aee3e32423a208f883831f1a0
humanhash: timing-pennsylvania-north-apart
File name:OdemePlani.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'203'389 bytes
First seen:2020-05-04 21:01:27 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:Oj2LTkBXCScELqSpKs2ir5qjZftVuem88uvtzz3f7:Oj2/e4ELhGxBlvt3j
TLSH 654533F70910A465C0458E0062D2A2AF5F5A95BDDC923AC5CB07B79E8ACECFCBD17E44
Reporter abuse_ch
Tags:AgentTesla geo r00 TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ileti.ziraatbank.com.tr
Sending IP: 45.147.231.229
From: ZIRAAT BANKASI <no_reply@ileti.ziraatbank.com.tr>
Reply-To: ZIRAAT BANKASI <no_reply@ileti.ziraatbank.com.tr>
Subject: T.C. Ziraat Bankası Ödeme Planı
Attachment: OdemePlani.r00 (contains "OdemePlani.exe")

AgentTesla SMTP exfil server:
mail.ashpraskills.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Script-AutoIt.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 21:36:57 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=szdcn4ol5qcmjuewwv4svtbr6mn2nm66ptqa5xehn7ex7tpqbbwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 964626f1cbec04c4d096b5792acc31f31ba6b3de7ce00edc876fc97fcdf0086d

(this sample)

AgentTesla

Executable exe 7fadf222ed69ea26d8273c481f82aa3b1985d35f9b885847a1e2f94774ff6b2f

  
Dropping
MD5 a2a1d8955b426b502bb1bf2abdd8ea8d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7fadf222ed69ea26d8273c481f82aa3b1985d35f9b885847a1e2f94774ff6b2f

Comments