MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d2f4222236d82303d5105f6287484bfe4d18517bc1b1591b007d43b7e864fc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d2f4222236d82303d5105f6287484bfe4d18517bc1b1591b007d43b7e864fc3
SHA3-384 hash: 0160ac479ddc5859864fbac808f14c3060649a582df80c0bdcd3948248347e29ae5a93a92de1d26e695d8486dd2eba7e
SHA1 hash: 59a25035c59b362e2df46b0bf56ddaf50565fff8
MD5 hash: b332e8498e604415e3dd98d88e0664c3
humanhash: emma-wisconsin-mars-connecticut
File name:ÖDEME TAVSİYESİ_Pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:592'862 bytes
First seen:2020-10-16 13:37:10 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:pnePyQTthkF+242u5My4tfWB6DsKs13r5yIOmeZuUc2uI/l:pnePxWbVuylJDhyNNegPI/l
TLSH EFC433D35F0AA644F4D8A2D4DC463766F1AB240D627F186ED01BE9B2A4DC0F92E360D7
Reporter abuse_ch
Tags:AgentTesla geo gz TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lancetti.ro
Sending IP: 82.77.62.25
From: ZİRAAT BANKASI <ziraatbankasi@ileti.ziraatbank.com.tr>
Subject: ZİRAAT BANKASI ÖDEME TAVSİYESİ
Attachment: ÖDEME TAVSİYESİ_Pdf.gz (contains "ÖDEME TAVSİYESİ_Pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d2f4222236d82303d5105f6287484bfe4d18517bc1b1591b007d43b7e864fc3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 12:24:13 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ruxueirdnwbdapkrax3cq5eex7sndbixxqnrlenqa7kdw7ugj7bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8d2f4222236d82303d5105f6287484bfe4d18517bc1b1591b007d43b7e864fc3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 8d2f4222236d82303d5105f6287484bfe4d18517bc1b1591b007d43b7e864fc3

(this sample)

AgentTesla

Executable exe 19cb1d89fb670dd31ceae6e0c41ffcf47767f6b3779804841f7aaf75adcd028f

  
Dropping
MD5 f356eea68fb8257b01e0907332e8a101
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 19cb1d89fb670dd31ceae6e0c41ffcf47767f6b3779804841f7aaf75adcd028f

Comments