MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ceb35b32c0ff7d8df348e6969aace9113964371fc9651c58ebaa55727af6ad67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ceb35b32c0ff7d8df348e6969aace9113964371fc9651c58ebaa55727af6ad67
SHA3-384 hash: 66fd4e8bcbd139fce5e193792ee89f5a04e88daf0def9d491e7c1436c3218afb2bcadb8cbe6e8588cf162fca178f7e4e
SHA1 hash: b4dd1c70af75c956903478dd99276ce4b71fd418
MD5 hash: e7c54f68d3f9a4c2c0afb05735019424
humanhash: tennessee-angel-nitrogen-cardinal
File name:[1909373834] MT103 Credit.jpg.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:519'489 bytes
First seen:2021-03-03 12:45:41 UTC
Last seen:2021-03-18 01:40:42 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:0n1cW76KTbco7hXvhiLkiASNPavRG2HA+VDkKCKNM7kZ8KsNiCc:0n1HEodXvhiLUyyVXaKhSk6Ksa
TLSH 60B4236AB7AF81DC5650EB76BABF3A513B1BB3F7A463292DD146003D0085C618DEC570
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
312
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ceb35b32c0ff7d8df348e6969aace9113964371fc9651c58ebaa55727af6ad67/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 12:46:07 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2zvwmwa756y342i42ljvlhjce4winy7zfsrywhlvjkxe6xwvvtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ceb35b32c0ff7d8df348e6969aace9113964371fc9651c58ebaa55727af6ad67

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace ceb35b32c0ff7d8df348e6969aace9113964371fc9651c58ebaa55727af6ad67

(this sample)

AgentTesla

Executable exe b83f14e836543dfd9080ebf68b7049c11e7e1fc46f2601980d581edfd725ad27

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b83f14e836543dfd9080ebf68b7049c11e7e1fc46f2601980d581edfd725ad27
  
Dropping
MD5 36b945a4c705990dcdb74dc3a6351e50

Comments