MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc49b2f3f376f51827b2d0fe47ddb9e3468bac57bcd2d285f3d4bc0db60897c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc49b2f3f376f51827b2d0fe47ddb9e3468bac57bcd2d285f3d4bc0db60897c8
SHA3-384 hash: 9c1bfa248f916e9484d247a7753035011ad4480c777ba0a63815b098ce0fc0e21d60d4b5c98a9c0b0d236abe4e51a680
SHA1 hash: ffe4fcc78fe02fcca321ba0331c25645e33db9e2
MD5 hash: 8c313918276d2c1d0996a8c5eca4e773
humanhash: romeo-lithium-avocado-lemon
File name:scancopy20200616_pdf.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:387'764 bytes
First seen:2020-06-16 18:42:46 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 6144:rKq/3kwNqXq4tgGlr3VczeJvQT0ICwijVGMyv8FtvpFIYjJ4Z:WaBgxr3zJv6jCwisvvoReY94Z
TLSH 898423B1014A872AEEB8AE64BA5D709FF65F110AB261FD071CE3833F5852D4478C50EB
Reporter cocaman
Tags:ace


Avatar
cocaman
Malicious email
From: Accounts <account01@shivamanigroup.com>
Received: from relay5-nb.vinahosting.com (211-125-120-188.k120.ptr.chiroro.ne.jp [211.125.120.188])
Date: Tue, 16 Jun 2020 20:36:37 +0700
Subject: Re: Payment Advice
Attachment: scancopy20200616_pdf.ace

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 13:22:12 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace dc49b2f3f376f51827b2d0fe47ddb9e3468bac57bcd2d285f3d4bc0db60897c8

(this sample)

AgentTesla

Executable exe df96c7a1be5f1de392872bc6810f49e90700b192696201b943ee958c77c40f07

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 df96c7a1be5f1de392872bc6810f49e90700b192696201b943ee958c77c40f07

Comments