MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d5e68fc3648494d7e73176b3d429eadaa9363b4dadc505758c2946a0d39b188. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d5e68fc3648494d7e73176b3d429eadaa9363b4dadc505758c2946a0d39b188
SHA3-384 hash: 48ca0764c7c0e25fff0ee845d574b595019afe6a9b8358c076524971ba8a2e26b04ef07e9604fb1971b42e6d7f645133
SHA1 hash: b9c57507294460b649a2c2846db2d1af78f34c1c
MD5 hash: 11c028e40457b03e5f24fcb8da3d9e89
humanhash: texas-eleven-violet-jersey
File name:TNT EXPRESS CONSIGNMENT.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:658'831 bytes
First seen:2020-09-28 05:28:03 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:B/PoU2/ilnG+PItlqHvxW7ok2SnymeCx2zUVLHiJbhbKFm8FZ:B4U2/0GNlqPw7eS9eCuUpiJbihFZ
TLSH 87E423706FFD2796843F94A52EC700D3011C1E09C1D6E9B90AE9A5D7324DB0AEFA74E8
Reporter cocaman
Tags:ace


Avatar
cocaman
Malicious email (T1566.001)
From: "TNT EXPRESS CONSIGNMENT <diamond@tnt.com>"
Received: "from awadbadinahas.com (vps41265.inmotionhosting.com [104.152.108.236]) "
Date: "Mon, 28 Sep 2020 08:08:35 +0300"
Subject: "TNT Express delivery Consignment Notification"
Attachment: "TNT EXPRESS CONSIGNMENT.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d5e68fc3648494d7e73176b3d429eadaa9363b4dadc505758c2946a0d39b188/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-09-28 05:18:46 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d5e68fc3648494d7e73176b3d429eadaa9363b4dadc505758c2946a0d39b188

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 6d5e68fc3648494d7e73176b3d429eadaa9363b4dadc505758c2946a0d39b188

(this sample)

AgentTesla

Executable exe cd1330f16e6849546ee8b46e8a81ce9fe10a70c1377e2179e71151df6bd9379c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cd1330f16e6849546ee8b46e8a81ce9fe10a70c1377e2179e71151df6bd9379c

Comments