MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32709eedf84e2ce481f8e508dfe7bf7b28ee7f6945f57120b1121a72372570b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32709eedf84e2ce481f8e508dfe7bf7b28ee7f6945f57120b1121a72372570b1
SHA3-384 hash: a20207d257090cb19f8af94ce072df84f1eff5bad01ee1e320c09e32c304a2d2b78ddd537d3eec5c48de5194eb8ae656
SHA1 hash: ff9fae30e05f858127853cad53dbbb69f0bdeab1
MD5 hash: 145c5e94dc5f1514fbdb52e68b7c78b0
humanhash: freddie-item-delaware-blue
File name:Proforma Invoice No.42037 For USD.78116.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:479'223 bytes
First seen:2021-03-30 05:41:36 UTC
Last seen:2021-03-30 08:37:40 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:t+3V3gDGRoqEjZWQ8gA+7tfQy3npMuz1qICHwiBq9:tyg4oLAQ8gP7ZQy5MuzGwiBq9
TLSH 33A42371D11B68820BC75307A179BDDABFF12C65174FDB9082E3B096A60F172B24C6B5
Reporter cocaman
Tags:ace AgentTesla INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: ""Account Department" <account@nijiconcept.com>" (likely spoofed)
Received: "from mageneet.com (unknown [45.144.225.201]) "
Date: "30 Mar 2021 06:21:04 +0200"
Subject: "[Top Urgent] Payment Advice For Proforma Invoice No.42037 dated 29/03/2021 for USD.78116/"
Attachment: "Proforma Invoice No.42037 For USD.78116.ace"

Intelligence

File Origin
# of uploads :
3
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32709eedf84e2ce481f8e508dfe7bf7b28ee7f6945f57120b1121a72372570b1/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 05:42:07 UTC
File Type:
Binary (Archive)
Extracted files:
41
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gjyj53pyjywojapy4uen7z57pmuo473jix2xcifrcinhenzfocyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/32709eedf84e2ce481f8e508dfe7bf7b28ee7f6945f57120b1121a72372570b1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 32709eedf84e2ce481f8e508dfe7bf7b28ee7f6945f57120b1121a72372570b1

(this sample)

AgentTesla

Executable exe 7cf241b7627c8ad2713e5db277835dfe1c872ff33865942dd553e7d088637ce5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7cf241b7627c8ad2713e5db277835dfe1c872ff33865942dd553e7d088637ce5
  
Dropping
AgentTesla

Comments