MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3169de9eef0fe8f4410d84330f984610dfe7488ecc1e429f5ef9699dc9af4b6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3169de9eef0fe8f4410d84330f984610dfe7488ecc1e429f5ef9699dc9af4b6c
SHA3-384 hash: e71b041772a97c9f16b78d56d935dbcbff35dedfdb94df3f7cb8ef1d7238658e7a208dc94eae784d4fd56d7933bff202
SHA1 hash: 445f6e1cde4a5fd2ffc2c042d680e9d6de8fe2bd
MD5 hash: b014c61dc7c23364808516884d840d4f
humanhash: two-edward-washington-batman
File name:Payment Slip.pdf.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:631'216 bytes
First seen:2021-03-17 17:09:38 UTC
Last seen:2021-03-18 05:33:37 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:6eJTpZ0QUkVLdz4+Cqc8R/U9ZJ/Y2IZ+LbliBnprq5slxBNztdpnCDg:nJ9ZU2dUL8F2J/Y2IQ1iBnMO/NJd9z
TLSH 99D423CF36687312F646964DCB6C3E3C9C396AB1C861883F1F685B49244D0CF954AEA7
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3169de9eef0fe8f4410d84330f984610dfe7488ecc1e429f5ef9699dc9af4b6c/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-17 17:10:08 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gfu55hxpb7upiqinqqzq7gcgcdp6oseozqpefh267fuz3snpjnwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/3169de9eef0fe8f4410d84330f984610dfe7488ecc1e429f5ef9699dc9af4b6c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 3169de9eef0fe8f4410d84330f984610dfe7488ecc1e429f5ef9699dc9af4b6c

(this sample)

AgentTesla

Executable exe 8198b25c1ecae80819efdb80290c0f2f77deaef6beccc8fb035e8e603c7808ca

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8198b25c1ecae80819efdb80290c0f2f77deaef6beccc8fb035e8e603c7808ca
  
Dropping
MD5 c0e8f801c50b1e9bec6944358b14e9ee

Comments