MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9675b3fae14b9ffc21ecbe9e918243ecdad1f37395c6fc2bf05843ac3f9fc111. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9675b3fae14b9ffc21ecbe9e918243ecdad1f37395c6fc2bf05843ac3f9fc111
SHA3-384 hash: cea047265112cb84f6f95be16b0d621e27ac1291a4c65e711e6d5cb29aa01c43bfeac849a31177896b46e3fbdb6a26c1
SHA1 hash: 17f4725e6438f06b166955faac36a49769d6240a
MD5 hash: 6e00f384a60291ef61153a4d3c716384
humanhash: india-fruit-avocado-earth
File name:Steel Clik PO#7770022460.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:522'580 bytes
First seen:2020-11-13 06:55:21 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:0Fei0273tr8oqNrR1zEmxmryQcrgnr54oU9vuJ:Ien27do7pjzEYgfnr
TLSH E6B4332E155C9FAA882D9041719F8074943A27AE25EB4E56F110F3F517E3FDEE8CE260
Reporter cocaman
Tags:ace


Avatar
cocaman
Malicious email (T1566.001)
From: "Giulia Chan <Giulia@505.nfdbon.ml>" (likely spoofed)
Received: "from xwx0.505.nfdbon.ml (xwx0.505.nfdbon.ml [134.209.67.215]) "
Date: "Thu, 12 Nov 2020 16:49:51 -0800"
Subject: "Purchase Order Number 7770022460"
Attachment: "Steel Clik PO#7770022460.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9675b3fae14b9ffc21ecbe9e918243ecdad1f37395c6fc2bf05843ac3f9fc111/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 00:41:49 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 9675b3fae14b9ffc21ecbe9e918243ecdad1f37395c6fc2bf05843ac3f9fc111

(this sample)

AgentTesla

Executable exe 6798c082a4a9eb0afdf9c180dcd967c472681dea15e61d89f9762182082c232e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6798c082a4a9eb0afdf9c180dcd967c472681dea15e61d89f9762182082c232e

Comments