MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fae5d8018a40c1763f8bd505bcabe42d460ccec44bed8fab2d970747604950e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 5
| SHA256 hash: | fae5d8018a40c1763f8bd505bcabe42d460ccec44bed8fab2d970747604950e2 |
|---|---|
| SHA3-384 hash: | d5523c9f0482e4ad8b6b89930eb1e146d52e9c2a0252f76d03ffe9681523893ec58d5dc90199b379c91a898dc372b569 |
| SHA1 hash: | e3dfb3148ea98d1131dc16d00e7c060a9f9ed918 |
| MD5 hash: | 9e93cfcd1f7e0cd2e500acc1b5d9a6d2 |
| humanhash: | robin-robert-seven-idaho |
| File name: | Ziraat Bankasi Swift Mesaji.r19 |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 261'374 bytes |
| First seen: | 2021-03-22 07:46:22 UTC |
| Last seen: | Never |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 6144:nbpgSPZkDVnHj17lSYp0KCxZ0jlnrWniCEbFMf1yI:NgSxkRDZwC0KCxgrkiCEbSwI |
| TLSH | 4444238545CA9C83915264D427191E21C7CF0E4DE8F6C8C47F227B2A271D6B86FB8CDB |
| Reporter |  abuse_ch |
| Tags: | AgentTesla geo r19 TUR ZiraatBank |
abuse_ch
Malspam distributing AgentTesla:HELO: yue0.grahnam.casa
Sending IP: 194.87.138.211
From: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Reply-To: ZIRAAT BANKASI <ziraatbank@ileti.ziraatbank.com.tr>
Subject: 19000, USD Swift Bildirimi
Attachment: Ziraat Bankasi Swift Mesaji.r19 (contains "Ziraat Bankasi Swift Mesaji.exe")
AgentTesla SMTP exfil server:
mail.bodrumosmanlialuminyum.com
AgentTesla SMTP exfil email address:
From: foreigntrade@bodrumosmanlialuminyum.com
To: foreigntrade@bodrumosmanlialuminyum.com
Intelligence
File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2021-03-22 07:47:09 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
5/5
Detection(s):
Malicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Dropping
AgentTesla
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.