MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2310d6d959459d72b10de5607cb6815cd84c2d1469c49ec34de9934781cded0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	2310d6d959459d72b10de5607cb6815cd84c2d1469c49ec34de9934781cded0c
SHA3-384 hash:	041ba0593e3646b14c66977a8a8b1cac11810342e9bc2f1665c4f1a93dc95c33b4b9c8e922c25a4af6591edbf0615330
SHA1 hash:	2434facad3b29fef29d7c19c110528b5c74207ce
MD5 hash:	2df48f46f8fc7f7770ac3eac5822eeab
humanhash:	south-cup-high-texas
File name:	invoice copy.img
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'310'720 bytes
First seen:	2023-07-04 11:30:52 UTC
Last seen:	2023-07-04 12:16:16 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	12288:Bm60OyTw+hKAbQG+1dLcXS/20dauNG1oQJxKELKP6EmA+CHPb4+x:90OyyWQjdL76KOoQJHuP6EmA5HPU+x
TLSH	T1CA555C3819BC5E22C575C3F58BA5C061B26495EF31A5CF2A2BC696C50B1EB0219C7E3F
TrID	50.6% (.ISO/UDF) UDF disc image (2114500/1/6) 49.0% (.NULL) null bytes (2048000/1) 0.1% (.ATN) Photoshop Action (5007/6/1) 0.0% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Reporter	cocaman
Tags:	AgentTesla img INVOICE

cocaman

Malicious email (T1566.001)
From: "Account department <rud-division@alkuhaimi.com>" (likely spoofed)
Received: "from alkuhaimi.com (unknown [45.66.230.34]) "
Date: "4 Jul 2023 14:14:33 +0200"
Subject: "Fwd: Reconfirm invoice"
Attachment: "invoice copy.img"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	INVOICE_.EXE
File size:	723'968 bytes
SHA256 hash:	8bd1453660f19a28f933707f5417b623a2edcd7e4dc606487145c2e76504a1a3
MD5 hash:	c438d9db3dd49b927d32663ca2f95552
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Iso_fs1493.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

context-iso masquerade packed

Link:

https://www.filescan.io/uploads/64a402f7cf99e7a5cfccbd14/reports/a1017c5a-d5e4-480b-b26b-5f3e31918789/overview

Verdict:

Malicious

Labled as:

Possibl.E94332FB

Link:

https://www.hybrid-analysis.com/sample/2310d6d959459d72b10de5607cb6815cd84c2d1469c49ec34de9934781cded0c

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2310d6d959459d72b10de5607cb6815cd84c2d1469c49ec34de9934781cded0c/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-07-04 11:30:55 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=eminnwkziwoxfmin4vqhznubltmeyliunhcj5q2n5gjupaon5uga._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.