MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d7dbb8d75863e896af97d660c12f67b61a53b35ae164a4d707012facb624519. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d7dbb8d75863e896af97d660c12f67b61a53b35ae164a4d707012facb624519
SHA3-384 hash: df554f3e3a56f5fa527a9ea500ae3d85cbf7e784de4453e491f13f59d4e632bce4daf5c4e604b02df1c53646b8cad3f7
SHA1 hash: ad2c1ff3e7738baa7d2eee662e797fd84d0c50e7
MD5 hash: 048579f691e6fe268d136660e522f9b1
humanhash: illinois-bulldog-lake-butter
File name:PAYMENT COPY.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:573'396 bytes
First seen:2023-06-16 13:38:55 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:r/0U4w+8zDG2/FmDGblwV/4Mt0Ps0GuTHWl6Q4DK3PLp8lF4nLnW:nX+tcmDGbOV/RtCYU2loDK3PLbLnW
TLSH T170C423AA6C1E37728B20375896F24757AB3433D7E3E665F2281CB8644AE05CF35C21D6
Reporter cocaman
Tags:ace AgentTesla payment


Avatar
cocaman
Malicious email (T1566.001)
From: ""IDBI BANK" <idbibank@idbibank.com>" (likely spoofed)
Received: "from mageneet.com (unknown [84.54.50.33]) "
Date: "16 Jun 2023 04:50:08 -0700"
Subject: "Overdue Payment Settlement Report - IBKLR92023061500006538"
Attachment: "PAYMENT COPY.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
CH CH
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/648c65f9fad28f3c32b68d1c/reports/ef2bdccd-4189-4227-977c-38ec6de35dc1/overview
Verdict:
Malicious
Labled as:
Mal/DrodAce
Link:
https://www.hybrid-analysis.com/sample/6d7dbb8d75863e896af97d660c12f67b61a53b35ae164a4d707012facb624519
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d7dbb8d75863e896af97d660c12f67b61a53b35ae164a4d707012facb624519/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2023-06-16 08:59:22 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nv63xdlvqy7is2xzpvtayexwpnq2kozvvyleutlqoajpvs3ciumq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6d7dbb8d75863e896af97d660c12f67b61a53b35ae164a4d707012facb624519

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ACE_Containing_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems) - based on Nick Hoffman' rule - Morphick Inc
Description:Looks for ACE Archives containing an exe/scr file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 6d7dbb8d75863e896af97d660c12f67b61a53b35ae164a4d707012facb624519

(this sample)

AgentTesla

Executable exe 3520f6322123eacd232b1dd107d892e852aa8cfa79eaf4fc3fb9c5b23893c948

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3520f6322123eacd232b1dd107d892e852aa8cfa79eaf4fc3fb9c5b23893c948
  
Dropping
MD5 9aeb260fe881bda509d3398ec57909ef

Comments