MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1708f19df810b86f030519cdd711889fbf711eb90d441451529a27d7996d53ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1708f19df810b86f030519cdd711889fbf711eb90d441451529a27d7996d53ec
SHA3-384 hash: 243eff113e6c13733559ece61dcd00d73992dd04c38dada7d5ad43cf37b719b58af75e76b89c41d5bdf87362405ac812
SHA1 hash: c6506e028bbfea87cf871b87090b19701177d981
MD5 hash: 9ae8cc65582c0ed19f7397d15c423f83
humanhash: four-alaska-ink-kitten
File name:Remittance Advice.pdf (2).ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:88'497 bytes
First seen:2021-06-23 11:58:45 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 1536:VTr5d6MuYiWsmZgFdysMCl7rlm0M4ITx3xg5SzEA2nyHsdSgY/HUPFjq5Y:Vf5gM9bsmZgFIHCl7r5M44x36YzynIef
TLSH CE8312A394E99DC1062C49CC971AB21683B2176377EF61C3F99186D406E2FEF8274347
Reporter cocaman
Tags:ace AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: "RACQ Accounts Payable <Accounts.Payable@racq.com.au>" (likely spoofed)
Received: "from racq.com.au (unknown [185.222.58.158]) "
Date: "23 Jun 2021 02:24:57 -0700"
Subject: "RE:Remittance Advice"
Attachment: "Remittance Advice.pdf (2).ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1708f19df810b86f030519cdd711889fbf711eb90d441451529a27d7996d53ec/
Threat name:
ByteCode-MSIL.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2021-06-23 11:59:08 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c4epdhpycc4g6ayfdhg5oemit67xchvzbvcbiukstit5pglnkpwa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla spyware stealer
Link:
https://tria.ge/reports/210623-kpeec7be32/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1708f19df810b86f030519cdd711889fbf711eb90d441451529a27d7996d53ec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 1708f19df810b86f030519cdd711889fbf711eb90d441451529a27d7996d53ec

(this sample)

AgentTesla

Executable exe dd6f56a703eb39c2d49b094d58ac1c96ad6af4f0dc4cb9c6f86ea40e4114f606

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd6f56a703eb39c2d49b094d58ac1c96ad6af4f0dc4cb9c6f86ea40e4114f606
  
Dropping
AgentTesla

Comments