MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 eb06960a500fe24202fc1c79f88d95da029499801dbd7eedf514a47e4ed82141. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 3
| SHA256 hash: | eb06960a500fe24202fc1c79f88d95da029499801dbd7eedf514a47e4ed82141 |
|---|---|
| SHA3-384 hash: | 71c66bb8ec7ff3d00b80755dfed5f78c597b177aa756166f6f4a482505f01777c447ab5eafbf209743bab46e48abe13f |
| SHA1 hash: | 9dd6bd42a30aef241ac0aa314e5f6e2f6d2e2371 |
| MD5 hash: | cbaaa35d1c09eaa95d3dde4d3d524631 |
| humanhash: | missouri-october-romeo-sodium |
| File name: | Halkbank_Ekstre_20210105_153330_883334.r00 |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 684'966 bytes |
| First seen: | 2021-01-08 08:14:44 UTC |
| Last seen: | Never |
| File type: | r00 |
| MIME type: | application/x-rar |
| ssdeep | 12288:VX3qGZ01vV9nX5MXS7NXMf3dRFnXJCSVZ+kwAej5b7ByS/POrJV8I7t8OlcJ0/48:cm0ZvJMXS74nXcnkwAelswPOrJV8I7tP |
| TLSH | 94E42348B0FC7D2DA21F466BA2ED60D023F09447B39103427594902B1BF986BCFEB59E |
| Reporter |  abuse_ch |
| Tags: | AgentTesla geo Halkbank r00 TUR |
abuse_ch
Malspam distributing AgentTesla:HELO: mail-cld-x20.trdns.com
Sending IP: 77.245.152.20
From: HALKBANK.E-EKSTRE <gulten@guldemir.com.tr>
Subject: T.HALK BANKASI A.Ş. 01.10.2020 - 31.12.2020 Hesap Ekstresi
Attachment: Halkbank_Ekstre_20210105_153330_883334.r00 (contains "Halkbank_Ekstre_20210105_153330_883334.exe")
AgentTesla SMTP exfil server:
mail.ascube.com.tr:587
AgentTesla SMTP exfil email address:
kalite@ascube.com.tr
Intelligence
File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2021-01-08 08:15:11 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
5/5
Detection(s):
Malicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Dropping
AgentTesla
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.