MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd0d2566fb983e69d025ec8fa81d21d9b18367f4d34ddcaccfacbde753254c79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd0d2566fb983e69d025ec8fa81d21d9b18367f4d34ddcaccfacbde753254c79
SHA3-384 hash: 9197067e289161a69c2ef2c1ec5647a4a8fdd3032d4d7fd8278bd33bc002acbb4f7f736de73e1e25a5c6575a208f826a
SHA1 hash: 7f821fa4485afbb49fa9acffe0369f67677f4fe0
MD5 hash: ce801fc389be8e035b022cb541f242d8
humanhash: oregon-tennessee-freddie-lion
File name:DHL Delivery Documents.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:656'950 bytes
First seen:2021-04-15 06:06:38 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:TSzMjxNWj17hzvhyr+ZsP8CzbrkeQO2mx/5Q4tJDVh8dwa2V+CO/1glkDWt:TSzMjxcj12r+ZsLZ2eG4rZh+U+DNglka
TLSH 9BD423D40572073A5B1EE1173F32E7660B36CAA3817A05F17DFAEE584C60287627E58E
Reporter cocaman
Tags:ace AgentTesla DHL


Avatar
cocaman
Malicious email (T1566.001)
From: ""DHL Customer Service" <custom.first@dhl.com>" (likely spoofed)
Received: "from mageneet.com (unknown [45.144.225.201]) "
Date: "15 Apr 2021 07:29:38 +0200"
Subject: "DHL Shipment Arrival Notification AWB NO: 2785998045621"
Attachment: "DHL Delivery Documents.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd0d2566fb983e69d025ec8fa81d21d9b18367f4d34ddcaccfacbde753254c79/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-04-15 02:34:02 UTC
File Type:
Binary (Archive)
Extracted files:
111
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ugskzx3ta7gtubf5sh2qhjb3gyygz7u2ng5zlgpvs66ouzfjr4q._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210415-3me59xzf1j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dd0d2566fb983e69d025ec8fa81d21d9b18367f4d34ddcaccfacbde753254c79

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace dd0d2566fb983e69d025ec8fa81d21d9b18367f4d34ddcaccfacbde753254c79

(this sample)

AgentTesla

Executable exe 410f33042e18da4bbcc65d94bd6c7cbe7da6643917f89ce38aa08130b8a20f26

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 410f33042e18da4bbcc65d94bd6c7cbe7da6643917f89ce38aa08130b8a20f26

Comments