MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e399620be0fc5f5de391da19130884b211c09e1c76bdb87b28c0191ede87df91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e399620be0fc5f5de391da19130884b211c09e1c76bdb87b28c0191ede87df91
SHA3-384 hash: 3167b72f6b369b41a8ed64f2e4d9b82e209e5cf2cd8e25c6c15ada2fd6dedd5eaa4521737a5c314c07d3af825492f06b
SHA1 hash: a7c9b3aaecbcb85f810efb4957e027de8f5f6c7f
MD5 hash: 9eb92fe1f545a0ffac1f7ff49a57fd24
humanhash: august-nineteen-hawaii-wisconsin
File name:SHIPPING DOCUMENTS_PDF.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:727'710 bytes
First seen:2021-03-31 05:59:02 UTC
Last seen:2021-03-31 06:01:46 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:ECH9E3jdSfWHI7YVvhy8LtzZNa4r3Xpz+8hAQpYCUbeb5z/ziCprqUvmkWPA2:xHy3QOHyUvhy8xna0XpCIpYCag/mC0UU
TLSH FCF423905906A2CE5B074E9D79188B552CE1F328F945D3DE30C4690EAFCDD7AE073EA2
Reporter cocaman
Tags:ace AgentTesla DHL INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL | Express Shipping <express@huiji.com>" (likely spoofed)
Received: "from budo170.adriahost.com (budo170.adriahost.com [95.211.77.34]) "
Date: "Wed, 31 Mar 2021 07:03:13 +0200"
Subject: "Shipping Documents, Invoice and AWB (March 2021)"
Attachment: "SHIPPING DOCUMENTS_PDF.ace"

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e399620be0fc5f5de391da19130884b211c09e1c76bdb87b28c0191ede87df91/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 05:13:34 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4omwec7a7rpv3y4r3imrgceewii4bhq4o263q6ziyamr5xuh36iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/e399620be0fc5f5de391da19130884b211c09e1c76bdb87b28c0191ede87df91

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace e399620be0fc5f5de391da19130884b211c09e1c76bdb87b28c0191ede87df91

(this sample)

AgentTesla

Executable exe 23cd04354a8a5eea8fc0908ae207a8d8c0449dd038cca3370e34d67cd74d2a77

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 23cd04354a8a5eea8fc0908ae207a8d8c0449dd038cca3370e34d67cd74d2a77
  
Dropping
AgentTesla

Comments