MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ba5ba8003b218fc08383266f3c8ebd124e1f3beb15aa8e3f8ae8c98987c3406. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ba5ba8003b218fc08383266f3c8ebd124e1f3beb15aa8e3f8ae8c98987c3406
SHA3-384 hash: d555e59eb3325ec617362bb9d06d373205d4fb16cb41b32c1d003e3d20e4c7d17056a237dbc2b77f105ad421781347a4
SHA1 hash: 33a4d28cff7239349d14cc91b976c9d844fa17cf
MD5 hash: d5b26f3b6d3103f400bd75cdb63906f3
humanhash: pluto-ink-cola-mountain
File name:Swift Transfer Copy mt103_PDF.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:668'981 bytes
First seen:2021-03-22 10:06:09 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:flWAIX/QBDuKM+L63cOBsNFXWuhq2sLkYAFInDt1MVHT8X3MaQsWimTfwi:fVEKMyapBsNhzhZqEQtGz8HWimB
TLSH E6E4237E8C5E596FB268DB2E15736E48681B6AFD7014E02174E112B8D2BEFE404CD437
Reporter cocaman
Tags:ace AgentTesla HSBC SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "HSBC SERVICES LTD <advice@mail.serviceshsbltd.com>" (likely spoofed)
Received: "from mailx.topola.com (mailx.topola.com [91.228.254.103]) "
Date: "Mon, 22 Mar 2021 15:30:31 +0800"
Subject: "AW: Fwd: Payment Advice -(22/03/2021) Advice Ref:[GLV319497487] /
Priority payment / Customer Ref:[F183344-00]"
Attachment: "Swift Transfer Copy mt103_PDF.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ba5ba8003b218fc08383266f3c8ebd124e1f3beb15aa8e3f8ae8c98987c3406/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 10:07:05 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pos3vaadwimpycbygjtphshl2esod456wfnkry7yv2gjrgd4gqda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/7ba5ba8003b218fc08383266f3c8ebd124e1f3beb15aa8e3f8ae8c98987c3406

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 7ba5ba8003b218fc08383266f3c8ebd124e1f3beb15aa8e3f8ae8c98987c3406

(this sample)

AgentTesla

Executable exe ab62d479188ea1f541b748cdeb04ddad8ebee4b32a1131f019bf0771a182c718

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab62d479188ea1f541b748cdeb04ddad8ebee4b32a1131f019bf0771a182c718
  
Dropping
AgentTesla

Comments