MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6de1e088ccc37ff8dc69feddb93f0c9174a11079bb515363baca3d1e4ae6c9f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6de1e088ccc37ff8dc69feddb93f0c9174a11079bb515363baca3d1e4ae6c9f0
SHA3-384 hash: efa6b6c0ad1f7e8b9ab83eaa55a62d9a217f2a8c3e63d6462ba97b5f5294d3c5c0e0006faf0c22481de5db42e1f2518e
SHA1 hash: 7fbca56b8547e3875345f144f964e4d8cc09789c
MD5 hash: 6c1a7cb82e087b38b86e3ba50371912b
humanhash: juliet-mississippi-iowa-single
File name:PO # 7770022460.jpg.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:419'847 bytes
First seen:2021-03-01 20:30:06 UTC
Last seen:2021-03-05 11:01:07 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:fFHB1DHo7lKPUYgE19YCL4ExuWlI0/2bhoms+:fF/HYMPTx9YCL4muWz0omL
TLSH E39423650502A924E2EDC7189036CEB88928CBBC753779C48EF8E71C1ECDD506F5EAB4
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
22
# of downloads :
133
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6de1e088ccc37ff8dc69feddb93f0c9174a11079bb515363baca3d1e4ae6c9f0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-01 16:19:51 UTC
File Type:
Binary (Archive)
Extracted files:
33
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nxq6bcgmyn77rxdj73o3spymsf2kcedzxnivgy52zi6r4sxgzhya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6de1e088ccc37ff8dc69feddb93f0c9174a11079bb515363baca3d1e4ae6c9f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 6de1e088ccc37ff8dc69feddb93f0c9174a11079bb515363baca3d1e4ae6c9f0

(this sample)

AgentTesla

Executable exe 7f4a3ac45b435858cfb65c8d0f10b5ed12ff573a64db1388939fae6a9d58f332

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f4a3ac45b435858cfb65c8d0f10b5ed12ff573a64db1388939fae6a9d58f332
  
Dropping
MD5 bf7af1872f36cdee10240f78025068a1

Comments