MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0561e4b9f0bc91f719a3e92ac56709869ae76c3bb9c36e48f4a9c1df5be91ae6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0561e4b9f0bc91f719a3e92ac56709869ae76c3bb9c36e48f4a9c1df5be91ae6
SHA3-384 hash: 3a3a94efce5cda23c3a9258b4a152c26d3fe520c4a0df69824c221f60e31f0c57f93314fb860f3bdf8237a801b74a322
SHA1 hash: b78a09db9e830f8a5510ce1ca34392904cb7ff4b
MD5 hash: 730203c0015445daa09d331f6fc1e5d9
humanhash: beer-glucose-lamp-august
File name:contact form.pdf.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:681'064 bytes
First seen:2021-04-02 10:05:35 UTC
Last seen:2021-04-06 04:17:52 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:VqTzwvKqZZKCLZzKQVUbVY/SXl0lZP23rVcJC5Zz1pgnIsebg/HZgoT2bDe7XBLI:ETz+KkmyUbVY/NGrO0g/HZgoTyDKyZTj
TLSH BCE4239E2CD38F6CCCB5169ABDBD42A327B625EA30B9D9A8D4C11804DC7F9A0C467135
Reporter cocaman
Tags:ace AgentTesla DHL


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Express Inc <support@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [185.222.57.200]) "
Date: "2 Apr 2021 01:07:29 -0700"
Subject: "DHL Express Your shipping address request"
Attachment: "contact form.pdf.ace"

Intelligence

File Origin
# of uploads :
3
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0561e4b9f0bc91f719a3e92ac56709869ae76c3bb9c36e48f4a9c1df5be91ae6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-02 02:01:20 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=avq6jopqxsi7ognd5evmkzyjq2noo3b3xhbw4shuvha56w7jdlta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/0561e4b9f0bc91f719a3e92ac56709869ae76c3bb9c36e48f4a9c1df5be91ae6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 0561e4b9f0bc91f719a3e92ac56709869ae76c3bb9c36e48f4a9c1df5be91ae6

(this sample)

AgentTesla

Executable exe 2372eaddae0b9ff47b6cc45c9ac7a5c508c3cf6fb4ecf858d953b287692385b8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2372eaddae0b9ff47b6cc45c9ac7a5c508c3cf6fb4ecf858d953b287692385b8
  
Dropping
AgentTesla

Comments