MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 216f9fd731e2e1e89be6720b9f4f379158a1e421f154199ac5d25a05ef919bca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 216f9fd731e2e1e89be6720b9f4f379158a1e421f154199ac5d25a05ef919bca
SHA3-384 hash: 0556cac0c1e921912e6d81a74543bb598f55c7ee659467d0ed516194f014c6459b6cdc1edf98691a4ebb8402365275b1
SHA1 hash: 477680f04cd0b56b56b54339e9adaf2953ec2441
MD5 hash: 1979e38fde72dacdf0d414aec9c03a51
humanhash: tennis-king-bravo-island
File name:SWIFT (8).ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:644'357 bytes
First seen:2021-02-05 15:06:30 UTC
Last seen:2021-02-09 06:56:39 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:Twhrd0pYnvdf72GymLZ0zzL/U8DksAH1yAg9pey1idpbbBqU15KFH:s2pYnvOW4rVAA5EdFb0US
TLSH ECD4232A6BC31DC9F0F6C1B3783A745800E91B1F053C4A6EBF52166A7A53767C1ACB94
Reporter cocaman
Tags:ace AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: ""Jane Ahn" <jane@914.xorox.ml>" (likely spoofed)
Received: "from diy0.914.xorox.ml (diy0.914.xorox.ml [178.128.47.48]) "
Date: "Fri, 05 Feb 2021 06:36:35 -0800"
Subject: "FW: Payment"
Attachment: "SWIFT (8).ace"

Intelligence

File Origin
# of uploads :
3
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/216f9fd731e2e1e89be6720b9f4f379158a1e421f154199ac5d25a05ef919bca/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 15:07:05 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=efxz7vzr4lq6rg7goifz6tzxsfmkdzbb6fkbtgwf2jnal34rtpfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/216f9fd731e2e1e89be6720b9f4f379158a1e421f154199ac5d25a05ef919bca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 216f9fd731e2e1e89be6720b9f4f379158a1e421f154199ac5d25a05ef919bca

(this sample)

AgentTesla

Executable exe ed8396aac536b4b8c046ea46999d8f788dd86ef73451efed3a2ff04f271e054a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ed8396aac536b4b8c046ea46999d8f788dd86ef73451efed3a2ff04f271e054a
  
Dropping
AgentTesla

Comments