MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 948293b2742334b3993ef32075ebcfb6b8f9cf4d5958f2998fd64392aed159b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 948293b2742334b3993ef32075ebcfb6b8f9cf4d5958f2998fd64392aed159b9
SHA3-384 hash: 188c470e67add3f6acf6fbeaa92b3e0ad4e136e1c8d4cd95ec14bd9655eb5e31dee167b09868ca04acb64e6d36ea85ff
SHA1 hash: 8b6e7ccd2130a894d91262dd2b2e2e387932a0c3
MD5 hash: 04d0dd94459f4df856908d07ea93a0c4
humanhash: uniform-moon-oven-blossom
File name:TNT Receipt_AWB87993766478.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:580'770 bytes
First seen:2020-11-18 06:35:33 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:ROdH2qwdTzlKH2yFVCXbUixCSkdom5SG02m814QKjPSBd+bm:ROFOTzlKHkoixCSkdV5uOaQKjSWbm
TLSH BAC42317512E1D11ED100A30AB484756389CFF8E13AA9B4AAAD1993F5D3E38FA5F1D8C
Reporter cocaman
Tags:ace


Avatar
cocaman
Malicious email (T1566.001)
From: "TNT Express <tnt@316.suaon.ml>" (likely spoofed)
Received: "from xwx0.316.suaon.ml (xwx0.316.suaon.ml [188.166.121.9]) "
Date: "Tue, 17 Nov 2020 16:49:18 -0800"
Subject: "TNT Express delivery Consignment Notification"
Attachment: "TNT Receipt_AWB87993766478.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/948293b2742334b3993ef32075ebcfb6b8f9cf4d5958f2998fd64392aed159b9/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 01:11:39 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 948293b2742334b3993ef32075ebcfb6b8f9cf4d5958f2998fd64392aed159b9

(this sample)

AgentTesla

Executable exe 685222a6d5d41bc23a1e4637ab8c3ed19d6075faaab2730d0f8599a24cd1c0a2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 685222a6d5d41bc23a1e4637ab8c3ed19d6075faaab2730d0f8599a24cd1c0a2

Comments