MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61a1a2d7cf20b6b9678ce8949b80f4e9192612cf10f339e2e415fc65b6f8bf93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61a1a2d7cf20b6b9678ce8949b80f4e9192612cf10f339e2e415fc65b6f8bf93
SHA3-384 hash: 00e8252aa4c2612039fe881349a2e19f287b0677f865ca9290a9852639a2979821ba671350e99485d75773172d255f1b
SHA1 hash: 44d4f4b432bd064574e2f23198f134dddea93f81
MD5 hash: 745013fad2ace21f86e8ee3f5112ca39
humanhash: golf-monkey-ten-artist
File name:Shipment Documents.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:764'310 bytes
First seen:2021-04-05 06:33:35 UTC
Last seen:2021-04-05 06:35:35 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:076DvpeiCTa0Acmm8iSYq0Pa4CDFmadyNVqWurOPOAML0BYcE9sAww/aEBT3Lc:08ciCTR0UnPa4CDFER2OPJMoEd1c
TLSH DEF423626BE203870BD822E9FE4F461A33B74AD210DA9463454640D06ABBDF375DF276
Reporter abuse_ch
Tags:ace AgentTesla


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mageneet.com
Sending IP: 45.144.225.201
From: Michael Han <sales12@ceaworld.com>
Subject: RE: Proforma Invoice No. AD1-2001028L, Packing List and Commercial Invoice for Urgent Shipment
Attachment: Shipment Documents.ace (contains "Shipment Documents.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61a1a2d7cf20b6b9678ce8949b80f4e9192612cf10f339e2e415fc65b6f8bf93/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-04-05 06:34:50 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mgq2fv6pec3lsz4m5ckjxahu5emsmewpcdzttyxecx6glnxyx6jq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/61a1a2d7cf20b6b9678ce8949b80f4e9192612cf10f339e2e415fc65b6f8bf93

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 61a1a2d7cf20b6b9678ce8949b80f4e9192612cf10f339e2e415fc65b6f8bf93

(this sample)

AgentTesla

Executable exe 8dd5ff17f444a8642bcd3601849987c6c202eaf344ba4dc606a216adffbdae4d

  
Dropping
MD5 29bc0daba728fd09457a8447bfcbb210
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8dd5ff17f444a8642bcd3601849987c6c202eaf344ba4dc606a216adffbdae4d

Comments