MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abef186d4b9c17616d8f86c5b2811718290cdd43fdc0876290a2a9c476c99068. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abef186d4b9c17616d8f86c5b2811718290cdd43fdc0876290a2a9c476c99068
SHA3-384 hash: e2a8a94a27c6a7e85698886f64f186a93588742b39463705c56ba4bed7317ac7a8a442b0bc755a4dfd1ea8da77dbdfb0
SHA1 hash: bfba8c71b374d1c6e87028211fd6486654ed8343
MD5 hash: d3cf40f8d427116a731643c65ec32bdd
humanhash: mockingbird-nitrogen-india-blue
File name:INVOICE & TELEX BL_PDF.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:727'711 bytes
First seen:2021-03-31 05:59:38 UTC
Last seen:2021-03-31 06:02:10 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:ICH9E3jdSfWHI7YVvhy8LtzZNa4r3Xpz+8hAQpYCUbeb5z/ziCprqUvmkWPA2:NHy3QOHyUvhy8xna0XpCIpYCag/mC0UU
TLSH 14F423905906A2CE5B074E9D79188B552CE1F328F945D3DE30C4690EAFCDD7AE073EA2
Reporter cocaman
Tags:ace AgentTesla DHL INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL | Express Shipping <express@huiji.com>" (likely spoofed)
Received: "from budo170.adriahost.com (budo170.adriahost.com [95.211.77.34]) "
Date: "Wed, 31 Mar 2021 07:03:13 +0200"
Subject: "Shipping Documents, Invoice and AWB (March 2021)"
Attachment: "INVOICE & TELEX BL_PDF.ace"

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abef186d4b9c17616d8f86c5b2811718290cdd43fdc0876290a2a9c476c99068/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 05:14:09 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
16 of 44 (36.36%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vpxrq3kltqlwc3mpq3c3faixdauqzxkd7xaioyuquku4i5wjsbua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/abef186d4b9c17616d8f86c5b2811718290cdd43fdc0876290a2a9c476c99068

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace abef186d4b9c17616d8f86c5b2811718290cdd43fdc0876290a2a9c476c99068

(this sample)

AgentTesla

Executable exe 23cd04354a8a5eea8fc0908ae207a8d8c0449dd038cca3370e34d67cd74d2a77

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 23cd04354a8a5eea8fc0908ae207a8d8c0449dd038cca3370e34d67cd74d2a77
  
Dropping
AgentTesla

Comments