MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 453884fd9c2498e084481af7478237c128940d57ad8340f35c8e513b8d3b95aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 453884fd9c2498e084481af7478237c128940d57ad8340f35c8e513b8d3b95aa
SHA3-384 hash: 87ba105b69fcc3af9f3837010d81b90e7a4ddcde9d961ec6d462309c2054f969a22b23cf44e28f6366d87a9defea7b89
SHA1 hash: 399304738c4e2334930d4280d4de7846739a6a9c
MD5 hash: 945c09f7b03e98f98a7a9ebd1e17f1eb
humanhash: shade-batman-lithium-delaware
File name:Payment copy.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:723'668 bytes
First seen:2021-03-16 15:02:44 UTC
Last seen:2021-03-18 04:48:45 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:o2F/sCC1zdnSZzEOEvk+igbeedZcRYhAFSmv33y1XYYPpC7nZ1yH87:o2CCEz1SZzTEvsgbv2Rx3fy1LxC7aS
TLSH 85F423DE1ECDF7C6F6ABA1569E48371A960A4005333508CD8AF947F977C5A930B60B34
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
8
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/453884fd9c2498e084481af7478237c128940d57ad8340f35c8e513b8d3b95aa/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 06:53:29 UTC
AV detection:
25 of 47 (53.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iu4ij7m4esmobbcidl3uparxyeujidkxvwbub424rzitxdj3swva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/453884fd9c2498e084481af7478237c128940d57ad8340f35c8e513b8d3b95aa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 453884fd9c2498e084481af7478237c128940d57ad8340f35c8e513b8d3b95aa

(this sample)

AgentTesla

Executable exe 6be2eabe49606c356a5e8a8e3a72d1092eccb5554aa28f4956ab0e338f46757c

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6be2eabe49606c356a5e8a8e3a72d1092eccb5554aa28f4956ab0e338f46757c
  
Dropping
MD5 6adecd32fe3b22bd519340aac49552ba

Comments