MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d17e6d2ef5257ca909859ac9f48e92faa7ddb77a13f5511c3aba9127090e501f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d17e6d2ef5257ca909859ac9f48e92faa7ddb77a13f5511c3aba9127090e501f
SHA3-384 hash: f633dac14574869fe3d0a42c2ba6e85b9c637e5de7b77d72edd18cf71a78993a10bc9a8976cd5fb781a9c99c40bb834c
SHA1 hash: 7d6d3265f2615034c21333fc24441eb55c5758fa
MD5 hash: 4d839be548fa76f51756e4eeb5fc2297
humanhash: utah-sodium-burger-low
File name:Ziraat Bankasi Swift Mesaji.r19
Download: download sample
Signature AgentTesla
Create hunting rule
File size:286'350 bytes
First seen:2021-01-19 13:08:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:OQSOhwyiX8ysVljWbw749o2PeXeI/wbRWN:DlVljWbwStKeMwYN
TLSH B05423D80A7D40BEE9C34C49B251D24A766D2BE4DB8D2490CCED00DE65D7CEE4EBA069
Reporter abuse_ch
Tags:AgentTesla geo r19 TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ileti.ziraatbank.com.tr
Sending IP: 45.147.229.19
From: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Reply-To: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Subject: 10000, EUR Swift Bildirimi
Attachment: Ziraat Bankasi Swift Mesaji.r19 (contains "Ziraat Bankasi Swift Mesaji.exe")

AgentTesla SMTP exfil server:
mail.beratun.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d17e6d2ef5257ca909859ac9f48e92faa7ddb77a13f5511c3aba9127090e501f/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 13:09:09 UTC
AV detection:
8 of 44 (18.18%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2f7g2lxvev6kscmftle7jdus7kt53n32cp2vchb2xkisociokapq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d17e6d2ef5257ca909859ac9f48e92faa7ddb77a13f5511c3aba9127090e501f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d17e6d2ef5257ca909859ac9f48e92faa7ddb77a13f5511c3aba9127090e501f

(this sample)

AgentTesla

Executable exe 1a9dfbc3aed67dd204ff8dae55a38bd28c250cb0ad9f8d150c4a6a4ee9b9f83e

  
Dropping
MD5 7337b54d1b22e7b1fe7f0db7f13724d5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1a9dfbc3aed67dd204ff8dae55a38bd28c250cb0ad9f8d150c4a6a4ee9b9f83e

Comments