MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 896b996560e0328d3c258ffa2d87e83868f00c69f9777e8f7bfd41ed83f14f95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 896b996560e0328d3c258ffa2d87e83868f00c69f9777e8f7bfd41ed83f14f95
SHA3-384 hash: 77086df0ccea46cb04ca62862a92d294cfe3c4845a73b6f721e2800a05be17fae7d65ccf003e69aea369c92af1843b14
SHA1 hash: f47c32c7894c2d1553268c9da127b2837076cbda
MD5 hash: bbef34d519656122d601c88fad9dee1a
humanhash: carolina-black-mango-mango
File name:Contact form.pdf.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:784'816 bytes
First seen:2021-04-12 15:38:02 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:Emy0UKc1o1SAx9MaZ6Z1nMdF0ttHH8EeLbdN5E7h3n3V658B9QYN8WGPHi5l/Jpg:krKAo1SAx9lWyktEdQh3l0k12vKtrZB4
TLSH A2F423C4591F1EBA71197C4E76C7CCFB242286090B6BB4FA4909C15E6BD15FAACF2312
Reporter cocaman
Tags:ace AgentTesla DHL


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL Express Inc <support@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [185.222.57.200]) "
Date: "12 Apr 2021 07:46:18 -0700"
Subject: "Re : Re : DHL Express Your shipping address request"
Attachment: "Contact form.pdf.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/896b996560e0328d3c258ffa2d87e83868f00c69f9777e8f7bfd41ed83f14f95/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-12 15:24:14 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rfvzszla4azi2pbfr75c3b7ihbupaddj7f3x5d337va63a7rj6kq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210412-143lpwxtzj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/896b996560e0328d3c258ffa2d87e83868f00c69f9777e8f7bfd41ed83f14f95

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 896b996560e0328d3c258ffa2d87e83868f00c69f9777e8f7bfd41ed83f14f95

(this sample)

AgentTesla

Executable exe 44e9c4cb56e317235ff3903e47b50db7b104353c1a889f0a05a5b48cdf53ad3b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 44e9c4cb56e317235ff3903e47b50db7b104353c1a889f0a05a5b48cdf53ad3b
  
Dropping
AgentTesla

Comments