MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d391ffa61513fd3ac699ba36782caee7e89460307e8ee3df31f8c1640fe29192. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d391ffa61513fd3ac699ba36782caee7e89460307e8ee3df31f8c1640fe29192
SHA3-384 hash: 203364a1de86c57e169e4b80a6ccbea9bccddbf8dc00a2ca2bd9f89a31adad4c7e8c14e54cf736e1e2348579722a8204
SHA1 hash: 18fbcd3e547cd4c14d1e7bab875f54070d251a61
MD5 hash: 7ddd96c365d1747ea5b1851da0da9a16
humanhash: ten-solar-timing-mango
File name:Halkbank_Ekstre_20200512_075758_612840.PDF.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:325'814 bytes
First seen:2020-05-12 09:05:23 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:fRUzG+2rxTs+B58NmJlp+bxsssZI9DH/4OxhaJN3KbnRovYh65ZJEp51uNFvIL:pQ2rNsw8nt5Tx/4OxMJaGxu0t4
TLSH 9764236F7F16980F5D416ECEB2D1248170D682EB0228F38EF94217AE352ED756722DE4
Reporter abuse_ch
Tags:AgentTesla geo Halkbank r00 TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: halkbank.com.tr
Sending IP: 156.96.58.98
From: HALKBANK.E-EKSTRE@halkbank.com.tr
Subject: T.HALK BANKASI A.Ş. 11.05.2020 Hesap Ekstresi
Attachment: Halkbank_Ekstre_20200512_075758_612840.PDF.r00 (contains "Halkbank_Ekstre_20200512_075758_612840.PDF.exe")

AgentTesla SMTP exfil server:
mail.newtorres.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 09:36:48 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2oi77jqvcp6tvruzxi3hqlfo47ujiybqp2hohxzr7dawid7csgja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 d391ffa61513fd3ac699ba36782caee7e89460307e8ee3df31f8c1640fe29192

(this sample)

AgentTesla

Executable exe 1382562537636cd649cde39adbd947ba650cc127e1a6675a082cf66e61192842

  
Dropping
MD5 6e8e9ecc18127adc43f7d79070378486
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1382562537636cd649cde39adbd947ba650cc127e1a6675a082cf66e61192842

Comments