MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db9e101a455cc5601582e029cae66c9d79c9042da5a0faf20aa145e47fd8f42d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db9e101a455cc5601582e029cae66c9d79c9042da5a0faf20aa145e47fd8f42d
SHA3-384 hash: 39b9815ebf06367700ded53efb1003bb07730608f6361305c261665f44571d6b66f818671aeb42cd7ddfdd2d15f41999
SHA1 hash: eabf83ded0901a19ca41d5a9f9532daba2c737bd
MD5 hash: b0d4920c81b2b52f8c711eda531f38b8
humanhash: whiskey-march-mountain-lactose
File name:Akbank Bildirimip_PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:508'060 bytes
First seen:2020-05-21 10:38:20 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:JRSol024xOz/s/x96NPtmJmYMxxjUu235e+v3qXudmc:iEd4xE0Z44JixxjKJ3v6edF
TLSH C2B423D183A729E26C550779ADB3105902B6D553A3C5CFBA8143BFAF5C432BE778020E
Reporter abuse_ch
Tags:AgentTesla Akbank geo gz TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: b2c01.promegahost.com
Sending IP: 77.223.142.96
From: AKBANK <noreply@akbank.com>
Subject: xxxx
Attachment: Akbank Bildirimip_PDF.gz (contains "Akbank Bildirimip_PDF.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.17.4982.18774.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 11:37:17 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz db9e101a455cc5601582e029cae66c9d79c9042da5a0faf20aa145e47fd8f42d

(this sample)

AgentTesla

Executable exe 6c731b9e623222de40d78c857573d713bafce156a4b42dd445a840fddfe585be

  
Dropping
MD5 6864baa092a9d571a6b2b90994695ec8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c731b9e623222de40d78c857573d713bafce156a4b42dd445a840fddfe585be

Comments