MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a87601c076e495cdec561910fba20095725f26b182abe18eb2dc3ea62a03a614. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a87601c076e495cdec561910fba20095725f26b182abe18eb2dc3ea62a03a614
SHA3-384 hash: 01bdb9df1b7d3c0e4651c65a05a5d0143551c39de27e66aed970ffc796543748fcd47ae8841d8f163f7c192eafb72ec7
SHA1 hash: aa98d176b95ea62743e6c16dc7a88ad119d140eb
MD5 hash: 30cc25d1b616e5608b2ecf834760b778
humanhash: stream-magazine-yankee-july
File name:285100727000782928_PDF.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:281'366 bytes
First seen:2021-03-03 07:38:44 UTC
Last seen:2021-03-05 08:41:45 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 6144:ta9DPmwt1vnRMHyLTBrl7BXiOR+jcxEvFAAamg2xRkHPPnCJiN:KtfRCeplViU+vDaasHHn9
TLSH 01542341B360FB2E007D32B3FE8264587A31A8CDE5B7D727845D50E47CC0A7AA55F486
Reporter abuse_ch
Tags:ace AgentTesla geo Sberbank SRB


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: Zillennium.com
Sending IP: 104.248.176.212
From: Sberbank <izvodi@mail.sberbank.rs>
Subject: Mesečni izvod za kreditnu karticu
Attachment: 285100727000782928_PDF.ace (contains "285100727000782928_PDF.exe")

Intelligence

File Origin
# of uploads :
10
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a87601c076e495cdec561910fba20095725f26b182abe18eb2dc3ea62a03a614/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 07:39:32 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vb3adqdw4sk433cwdeipxiqasvzf6jvrqkv6ddvs3q7kmkqduyka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/a87601c076e495cdec561910fba20095725f26b182abe18eb2dc3ea62a03a614

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace a87601c076e495cdec561910fba20095725f26b182abe18eb2dc3ea62a03a614

(this sample)

AgentTesla

Executable exe 168d180de146160d0ba93335e36e00d62029ea13f0a41ace68a76e8a2b547ac3

  
Dropping
MD5 a914891bd3e31b73143c2c6768b41887
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 168d180de146160d0ba93335e36e00d62029ea13f0a41ace68a76e8a2b547ac3

Comments