MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf0ea40d340fb0a29c9d1e414b2855c038c2b14a13296cc1ce08afd71333afc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf0ea40d340fb0a29c9d1e414b2855c038c2b14a13296cc1ce08afd71333afc2
SHA3-384 hash: 469299107e10542f65b96e45f6bc4eb19567f5a94ba62410fb7c737860b5b2d9893490cfc2e0680e64022f77cef1ab41
SHA1 hash: 2e0bfd8db2ea4ac319bedac0042ace295c4193f6
MD5 hash: 79e7c1fcd623b113defaf8dfb2953ce2
humanhash: delaware-oscar-music-whiskey
File name:Halkbank_Ekstre_20200528_080247_232393pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:416'256 bytes
First seen:2020-05-28 12:47:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qMCzLa+a+5ooLj0zVSFSCKb6eaoPFI3LuxKY2Qbq:q1W+aDlwEB6e/dIqKYu
TLSH 8A9423AF49F3A891B373D0B551AECC1B78CC1185FB88079B1AEFE820217176BD416D62
Reporter abuse_ch
Tags:AgentTesla geo Halkbank TUR z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: halkbank.com.tr
Sending IP: 193.29.187.182
From: halkbank.e-ekstre@halkbank.com.tr
Subject: T.HALK BANKASI A.Ş. 28.05.2020 Hesap Ekstresi
Attachment: Halkbank_Ekstre_20200528_080247_232393pdf.z (contains "Halkbank_Ekstre_20200528_080247_232393pdf.exe")

AgentTesla SMTP exfil server:
mail.semsreklam.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.5972.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:38:21 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip bf0ea40d340fb0a29c9d1e414b2855c038c2b14a13296cc1ce08afd71333afc2

(this sample)

AgentTesla

Executable exe 0f6ebc0016da851a5c48bfe7ce83697344353c84ae5ace666225f8742b30aafc

  
Dropping
MD5 61e908cd7bdd9daa2c44c8eae91513af
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f6ebc0016da851a5c48bfe7ce83697344353c84ae5ace666225f8742b30aafc

Comments