MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56a8d64cb552b9ffcfdec5d4be10ec3df5cd136da9ece67fd7c7b757e10f8052. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56a8d64cb552b9ffcfdec5d4be10ec3df5cd136da9ece67fd7c7b757e10f8052
SHA3-384 hash: 95ad11400dfb98217bee95a45a4414a777fee3d4b7b98a92659b3ffbdc11f57fbb0b15cde725cff5e8562fb390fe8945
SHA1 hash: 54c07eb14f1e5985b224b6f089f54beedf4f17fd
MD5 hash: cfc4dc75760c5b466f184f351cb476e8
humanhash: sierra-magazine-nevada-social
File name:cts new.pdf.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:668'239 bytes
First seen:2021-04-09 17:16:55 UTC
Last seen:2021-04-09 17:55:46 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:5SOh+AoSdS9kXRIeV0Lfff8BTbpb5xtwh05ScPdku62bKrTZtci9S5atnUSJ5Bf:rhToSs9kXOOMfcBTbPxtwKEcPdkd2OTb
TLSH 4DE42310205A03D1448557FEC9745C5853C28BB09BF633F6A9EEBB8D3EDEA2A1956F03
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56a8d64cb552b9ffcfdec5d4be10ec3df5cd136da9ece67fd7c7b757e10f8052/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-09 17:17:09 UTC
File Type:
Binary (Archive)
Extracted files:
37
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k2unmtfvkk477t66yxkl4ehmhx242e3nvhwom76xy63vpyipqbja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/56a8d64cb552b9ffcfdec5d4be10ec3df5cd136da9ece67fd7c7b757e10f8052

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 56a8d64cb552b9ffcfdec5d4be10ec3df5cd136da9ece67fd7c7b757e10f8052

(this sample)

AgentTesla

Executable exe 40d5467b45bd8a62d670278a3f4e6440dddcfabf057913ea76bb15ce5384b196

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 40d5467b45bd8a62d670278a3f4e6440dddcfabf057913ea76bb15ce5384b196
  
Dropping
MD5 7c49a5e90fddd3e4281bcf9df26620fe

Comments