MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 577b6bc2e507a84e137c0a11862a0cc827fe0621c70b5936df665b93a2b0beda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 577b6bc2e507a84e137c0a11862a0cc827fe0621c70b5936df665b93a2b0beda
SHA3-384 hash: c938697173b09dabf458a2a0d9e7e86d1db60fc12345fd58f632fcd5f13f1522a3bdf355638cc541544e8b5513775703
SHA1 hash: b69c59880bbc718c6a176414d5b193251c2eedf3
MD5 hash: f12fd87f6fc477292a45d1b9f4bb4b49
humanhash: maine-burger-high-april
File name:Ziraat Bankasi Swift Mesaji.r19
Download: download sample
Signature AgentTesla
Create hunting rule
File size:263'642 bytes
First seen:2021-03-09 14:16:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Mrfzm812FSP/lCA0Ih/DcV2AaVht8THhO7Y9NxtHN0xH:MrLm83lCA072AartAHhAINDi
TLSH 6A442345B0DF1265A9FD9FE304CCB10ABD8E4C944CD31DB6C9E674A295D2BB4AB0E4B0
Reporter abuse_ch
Tags:geo r19 TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: yue0.grahnam.casa
Sending IP: 194.87.138.211
From: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Reply-To: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Subject: 20000, EUR Swift Bildirimi
Attachment: Ziraat Bankasi Swift Mesaji.r19 (contains "Ziraat Bankasi Swift Mesaji.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Spyware.Convagent
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 14:17:07 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k55wxqxfa6ue4e34biiymkqmzat74brby4fvsnw7mznzhivqx3na._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/577b6bc2e507a84e137c0a11862a0cc827fe0621c70b5936df665b93a2b0beda

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 577b6bc2e507a84e137c0a11862a0cc827fe0621c70b5936df665b93a2b0beda

(this sample)

AgentTesla

Executable exe 2ff867e475abe496c04c7a4193d8cdb9d5687846fd3d61bbb439aaab0d9f7496

  
Dropping
MD5 63ace791092dc37993022fcb537e23df
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ff867e475abe496c04c7a4193d8cdb9d5687846fd3d61bbb439aaab0d9f7496

Comments