MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b7ba69d31cabab64d6edc2d0891479d6ada350bf5a74e6ef8fd1fadd3dc3992. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b7ba69d31cabab64d6edc2d0891479d6ada350bf5a74e6ef8fd1fadd3dc3992
SHA3-384 hash: a178bf73b6653bc6a35e62683b0a6b512215d8b452f06333972b054f71615e95cef25ab98b2d67ee17a52a7c2a7e0c65
SHA1 hash: 1ea1f4df2c9e9670503e8a00e39fd06fe5ac20e2
MD5 hash: 8da0e35ad931431d57212877fef2715f
humanhash: connecticut-monkey-yankee-beer
File name:Payment Advice.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:363'786 bytes
First seen:2020-07-27 09:45:44 UTC
Last seen:2020-07-29 05:21:41 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 6144:/0lTA1x5DO/cXcmy2KgcBSPPlPrR7EHI6Ib33Hk5YGoqjDprvYxJU3YQCAtT:8lTAZC/scYxZRyIr6oEhe235tT
TLSH 047423A5B709C13D687D250B7362469BC339F49A4097FE602DE03E4D40F19293EAB9E6
Reporter cocaman
Tags:ace AgentTesla


Avatar
cocaman
Malicious email
From: Careers Davegroup <careers@davegroup.lk>
Received: from outgtw02.dialog.lk (outgtw02.dialog.lk [125.214.169.206])
Date: Wed, 29 Jul 2020 04:08:59 +0530 (IST)
Subject: Payment Advice For Invoice #17601 [TOP URGENT]
Attachment: Payment Advice.ace

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b7ba69d31cabab64d6edc2d0891479d6ada350bf5a74e6ef8fd1fadd3dc3992/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-27 09:47:05 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9b7ba69d31cabab64d6edc2d0891479d6ada350bf5a74e6ef8fd1fadd3dc3992

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 9b7ba69d31cabab64d6edc2d0891479d6ada350bf5a74e6ef8fd1fadd3dc3992

(this sample)

AgentTesla

Executable exe 3552a1f77c3b33e67b58befea74f96638eb02f73ce2b386115e4c3ed85534f87

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3552a1f77c3b33e67b58befea74f96638eb02f73ce2b386115e4c3ed85534f87
  
Dropping
AgentTesla

Comments