MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2d2b9d32b6b75cb22370784edd3093c591b14aad39733401153cc017eadd3fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2d2b9d32b6b75cb22370784edd3093c591b14aad39733401153cc017eadd3fa
SHA3-384 hash: ca35712206a653122c32df160c39b70b602ebba7c81c577b4816e481066c870bc359fffc7fa6a408a3aa4d913446fee7
SHA1 hash: 314b5bd749ef2aa21d9d30e0a5983d2996f66936
MD5 hash: e3aa1a20107b7401d9179f72ebbe2ebd
humanhash: purple-nitrogen-snake-lake
File name:T. HALK BANKASI A.S.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:228'112 bytes
First seen:2020-06-18 09:46:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+gi86DB63M73cwZKwucxCMiTiZ519I0bRkQqKy4QBN876XNeqo1LSs:3i8Io5GAMiTiZ51e47fWK8XoRV
TLSH 182423FEAB1D341A558B8CF2C08AFB3676CD1A28B25B391C4D30C65C4A30E565EAC1E1
Reporter abuse_ch
Tags:AgentTesla geo Halkbank TUR zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: halkbank.com.tr
Sending IP: 83.136.106.168
From: HALKBANK.E-EKSTRE@halkbank.com.tr
Reply-To: HALKBANK.E-EKSTRE@halkbank.com.tr
Subject: T.HALK BANKASI A.S. 18.06.2020 Hesap Ekstresi
Attachment: T. HALK BANKASI A.S.zip (contains "T. HALK BANKASI A.S.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.25710.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 10:37:36 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ljltuzlnn24wirxa6co3uyjhrmrwffk2oltgqarkpgac7vn2p5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f2d2b9d32b6b75cb22370784edd3093c591b14aad39733401153cc017eadd3fa

(this sample)

AgentTesla

Executable exe 800a8e18808d87e49f2212b65075820db611ce930bcc18abdc12f3915c7e1e70

  
Dropping
MD5 dfb4a9a40e631e5a9b51440116d04af8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 800a8e18808d87e49f2212b65075820db611ce930bcc18abdc12f3915c7e1e70

Comments