MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29c1665d4cb849c590f99c666edc46d436b7bf25e3d2638105c7ad73c6a6aa0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29c1665d4cb849c590f99c666edc46d436b7bf25e3d2638105c7ad73c6a6aa0e
SHA3-384 hash: 22dcfe884a7694db28d1a624078a2ae78094858c2b2eb0947f11591ec4eae041ca81615c01f034781ff5cf333ffe93b8
SHA1 hash: 511b073de8cd7913b02b77563bc6a20457aa5ac2
MD5 hash: 1eb6593413dc59593086c45c4b056404
humanhash: papa-princess-six-table
File name:PO #047428.Img.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:622'622 bytes
First seen:2021-03-04 09:24:41 UTC
Last seen:2021-03-05 10:23:41 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:DIE+uOdOdNEJu16cvZtPQx+fUsyFQ9OkHWDytrmnwRQMI:DIF1dOdNE2RtP2TI/2etrmn3MI
TLSH B8D42319130FFE3628DEDAE248E1A5CA8F433877AD60407383B5BCDBC5FAA2555D5284
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
5
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29c1665d4cb849c590f99c666edc46d436b7bf25e3d2638105c7ad73c6a6aa0e/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 09:25:07 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fhawmxkmxbe4lehztrtg5xcg2q3lppzf4pjghaify6wxhrvgviha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/29c1665d4cb849c590f99c666edc46d436b7bf25e3d2638105c7ad73c6a6aa0e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 29c1665d4cb849c590f99c666edc46d436b7bf25e3d2638105c7ad73c6a6aa0e

(this sample)

AgentTesla

Executable exe 27dcd9778b97a02454b9d43e22c188cbc7028367b311496b463a6f7d773e9f6f

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27dcd9778b97a02454b9d43e22c188cbc7028367b311496b463a6f7d773e9f6f
  
Dropping
MD5 f25913deea28a4588c9b32407be1ecf7

Comments