MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1b2dc3e8d5ec53eddd0b4573ff23a0af35a5ee331ab6482b4433af89deb47ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: a1b2dc3e8d5ec53eddd0b4573ff23a0af35a5ee331ab6482b4433af89deb47ab
SHA1 hash: dbff188bb5df70361ac898aeea48acc5fb65874c
MD5 hash: 8c29db44d1d319dc3d76e81a144fac60
File name:Halkbank_Ekstre_20200522_080247_232393.pdf.r00
Download: download sample
Signature AgentTesla
File size:975'042 bytes
First seen:2020-05-22 13:54:19 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:EHn7fnjo6oexCYIA6i5xYlHUdT66CQvC0qK9TYg/:IbnM6oelBOHUV66ytg/
TLSH 5125336C1F6B4A7F2E1A72A0848055FF1DD9BDF656FF93ADD288F6B41A4052080D8D22
Reporter @abuse_ch
Tags:AgentTesla geo Halkbank r00 TUR


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: halkbank.com.tr
Sending IP: 193.29.187.182
From: HALKBANK.E-EKSTRE@halkbank.com.tr
Subject: T.HALK BANKASI A.Ş. 21.05.2020 Hesap Ekstresi
Attachment: Halkbank_Ekstre_20200522_080247_232393.pdf.r00 (contains "Halkbank_Ekstre_20200522_080247_232393.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 22
Origin country FR FR
ClamAV No detection
VirusTotal:Virustotal results 29.51%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 a1b2dc3e8d5ec53eddd0b4573ff23a0af35a5ee331ab6482b4433af89deb47ab

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments