MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 246a80ed2d4f99fa9670298eaf420d779dd07ac5f5ec5832b02ececd723550a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 246a80ed2d4f99fa9670298eaf420d779dd07ac5f5ec5832b02ececd723550a8
SHA3-384 hash: e41339bf2189640c58b6cb1ea1d006c5f03ce074aefc01cd00f9dabdf9fd6d3bdf55c54fb1f6562d439b7a03f5deaf40
SHA1 hash: 841ce2a9b83280b127c151fed0ed723f71094792
MD5 hash: 98c1a61e495691a600b09e4969da9fe6
humanhash: carpet-summer-maine-carpet
File name:Purchase Order no 7770022460.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:726'776 bytes
First seen:2021-01-22 06:25:46 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:eB8xeeBxFw4F2xLSBIodaj7X90TVe5G4VYHQy3aq/QJmVQx2KNcdcs8cen:eB83BxFT0xSnduN0Je5zU39buMcNn
TLSH 26F423389834463842CD26A991E74A6F744F7AC4DA23DFDEA640367E7EE3D931C6C201
Reporter cocaman
Tags:ace


Avatar
cocaman
Malicious email (T1566.001)
From: "Giulia Chan <office2@ausemov.com>" (likely spoofed)
Received: "from slot0.ausemov.com (slot0.ausemov.com [45.85.90.197]) "
Date: "Thu, 21 Jan 2021 18:50:19 -0800"
Subject: "Purchase Order Number 7770022460"
Attachment: "Purchase Order no 7770022460.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/246a80ed2d4f99fa9670298eaf420d779dd07ac5f5ec5832b02ececd723550a8/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-01-22 06:26:05 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
11 of 44 (25.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/246a80ed2d4f99fa9670298eaf420d779dd07ac5f5ec5832b02ececd723550a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 246a80ed2d4f99fa9670298eaf420d779dd07ac5f5ec5832b02ececd723550a8

(this sample)

AgentTesla

Executable exe 98cea7e20d6760aa8052e7be2968a74df11f602bf9860243631f1a56140fa13c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98cea7e20d6760aa8052e7be2968a74df11f602bf9860243631f1a56140fa13c

Comments