MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4470130ded18cc1b839836a5c61dad249f6c448a53c1df45d9f4fad9027cf4b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4470130ded18cc1b839836a5c61dad249f6c448a53c1df45d9f4fad9027cf4b8
SHA3-384 hash: bb78028725f03e2791cbe4aae4ac30b4d4a7eed46d92c2488127034683effd970768bc469316684b18528d82538d117c
SHA1 hash: 9d71fc621f06bffd003f82fa8d1c8513d32a9cdb
MD5 hash: 45fb7f928b15e8fed2475fe732de4fc2
humanhash: arizona-ten-double-eighteen
File name:OdemePlani.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:977'098 bytes
First seen:2020-05-12 15:30:15 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:2myHDssCpr268j3tafg9Be0ci8LV5IKDfm44hoRbgGPG:2mYau40ci+PDfmtcbgGu
TLSH 922533DD734DF3D169CA1E1B8EB1217A5F3FB4914498520AD4924730CACA41EC9EEA3E
Reporter abuse_ch
Tags:AgentTesla geo r00 TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ileti.ziraatbank.com.tr
Sending IP: 45.147.231.229
From: ZIRAAT BANKASI <no_reply@ileti.ziraatbank.com.tr>
Reply-To: ZIRAAT BANKASI <no_reply@ileti.ziraatbank.com.tr>
Subject: T.C. Ziraat Bankası Ödeme Planı
Attachment: OdemePlani.r00 (contains "OdemePlani.exe")

AgentTesla SMTP exfil server:
mail.boreltekno.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 15:35:55 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=irybgdpnddgbxa4yg2s4mhnnespwyrekkpa56roz6t5nsat46s4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 4470130ded18cc1b839836a5c61dad249f6c448a53c1df45d9f4fad9027cf4b8

(this sample)

AgentTesla

Executable exe 6dc407eb41b8a813558364ae42dcdcce2019209615cc73141b9b6b91de15fd29

  
Dropping
MD5 5b8dc03f41e9b9eae3897a467a33602b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6dc407eb41b8a813558364ae42dcdcce2019209615cc73141b9b6b91de15fd29

Comments