MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6a9cc1cbeeccf3fe5094ca184828f911f846744160468396ab0091560515224. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6a9cc1cbeeccf3fe5094ca184828f911f846744160468396ab0091560515224
SHA3-384 hash: bce73a898f55a1069a1d8a2ae5f2fd6abc39f9b32038a722e3fc2378e4c3b3a73dac07ef02fc831f25fa1814080c8d97
SHA1 hash: 9e0b1a06f5f821368bc7b591904a90f442e1db5e
MD5 hash: bad5eb977a615f4d6216fb50dff14dab
humanhash: butter-bluebird-xray-maine
File name:Ziraat Bankasi swift PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:895'019 bytes
First seen:2020-06-03 10:14:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:l3VSTsu5IvdxfOsqimRfGWBmhGbpKyj+2h+FuplnuKAL:m5uGsAfBsA7j+2h+QHuKE
TLSH C815236CC6F69676BFACDEE6E81DCBA4101B7C29641F72491203F942D3903E726F8046
Reporter abuse_ch
Tags:AgentTesla geo rar TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.birboluiki.com
Sending IP: 185.226.161.11
From: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Subject: 8,200.00 USD Swift Bildirimi
Attachment: Ziraat Bankasi swift PDF.rar (contains "Ziraat Bankasi swift PDF.exe")

AgentTesla SMTP exfil server:
reseller16.webserversystems.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Aitinject
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 10:36:44 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
29 of 48 (60.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y2u4yhf65tht7zijjsqyjaupsepyiz2ecycgqolkwaerkycrkisa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c6a9cc1cbeeccf3fe5094ca184828f911f846744160468396ab0091560515224

(this sample)

AgentTesla

Executable exe fb378b9273a8ad6fc831744553c53a0b13ff5c9e59063564b65e7da2d126c90f

  
Dropping
MD5 d23880eae98b7b8bee11775d76edc2fe
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fb378b9273a8ad6fc831744553c53a0b13ff5c9e59063564b65e7da2d126c90f

Comments