MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3e2e335adb567e9d72c7ce752d5352fa18f8d6505b5d11af95df3c4a73f532f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3e2e335adb567e9d72c7ce752d5352fa18f8d6505b5d11af95df3c4a73f532f
SHA3-384 hash: 3937775fcf85bcbd798b35894b9fdfb386e5e1564362407c0e84295632f1b16fa7d67646393f8466eca56f22ea2e47e9
SHA1 hash: f94b885a088d1c6069e7c781f23057e24c7468ae
MD5 hash: c6e40a1f7ceb3e7d9ce8e989c58e21cb
humanhash: idaho-yellow-rugby-lemon
File name:Draft Contract - English Language.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:491'089 bytes
First seen:2021-02-10 06:23:16 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:k3jFkpXEMv2oAkI2Iee2/B5GeoiJXIiXGUczZIKJ37B:GFkpXBVVIeee7xVIrUUfJ37B
TLSH 62A423CB4CE797EC7E6C6E7857DCC18E9C750466A0C981F42367238F1B29B499638326
Reporter cocaman
Tags:ace AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?7KCV7J287ISd?= <zzjaa@zzjms.net>" (likely spoofed)
Received: "from zzjms.net (unknown [45.137.22.138]) "
Date: "9 Feb 2021 19:11:46 -0800"
Subject: "=?UTF-8?B?6rOE7JW97IScIOyDmO2UjCAtIFNhbXBsZSBjb250cmFjdA==?="
Attachment: "Draft Contract - English Language.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3e2e335adb567e9d72c7ce752d5352fa18f8d6505b5d11af95df3c4a73f532f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 02:23:43 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yprognnnwvt6tvzmpttvfvjvf6qy7dlfaw25cgxzlxz4jjz7kmxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c3e2e335adb567e9d72c7ce752d5352fa18f8d6505b5d11af95df3c4a73f532f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace c3e2e335adb567e9d72c7ce752d5352fa18f8d6505b5d11af95df3c4a73f532f

(this sample)

AgentTesla

Executable exe bc98bced9609415a65200ba31e31dd6c30f393ca0e7e5d4f2f20b63ce3889a80

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bc98bced9609415a65200ba31e31dd6c30f393ca0e7e5d4f2f20b63ce3889a80
  
Dropping
AgentTesla

Comments