MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c458185b7132e9ddefff47aa37a1c0da2f6db354d9db73f715cb74d80a0a854. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c458185b7132e9ddefff47aa37a1c0da2f6db354d9db73f715cb74d80a0a854
SHA3-384 hash: db82deafbb54c2014397bc2222778a75037c8cc2552eeb731e36133ece2559719788e910bef46568c86de8cbce06b704
SHA1 hash: e4a88fd72e8ce0b2e3d253b58a0ac62be4138af0
MD5 hash: cf6f19506adf9f63e7ff1787c68d9daa
humanhash: lion-island-twelve-asparagus
File name:PURCHASE LIST.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:775'599 bytes
First seen:2023-01-11 07:57:03 UTC
Last seen:2023-01-11 08:01:28 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:0epj9I8zZGubP1c+iBmucUWvp3eKJZYQFE25q0p9wXVWcN/a3q6UYKxw2hEx22iV:vz517sBmuXW9eBQFZoWoNyq6D0gPA
TLSH T18AF433C49D79144F9301442AD84A2BF6D99E3BF2EE047D9BB328D73644C68C20C2E5EE
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Karen Zhang <sales@haiangroup.com>" (likely spoofed)
Received: "from haiangroup.com (unknown [103.141.138.139]) "
Date: "10 Jan 2023 12:29:18 -0800"
Subject: "PURCHASE ORDER"
Attachment: "PURCHASE LIST.pdf.zip"

Intelligence

File Origin
# of uploads :
9
# of downloads :
82
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:PURCHASE LIST.pdf.exe
File size:903'168 bytes
SHA256 hash: f2b319e1d2fdad6549ad9f56894221d7c3f8706d96012316dae1b52231a46247
MD5 hash: c8cb659f339977e11307d13ec75711ab
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/2c458185b7132e9ddefff47aa37a1c0da2f6db354d9db73f715cb74d80a0a854/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63be6bd5a70bef46551e70d8/reports/ac852371-9525-412b-b5ad-cd38b4bba4e6/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c458185b7132e9ddefff47aa37a1c0da2f6db354d9db73f715cb74d80a0a854/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-01-10 13:30:50 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
23 of 40 (57.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=frcydbnxcmxj3xx76r5kg6q4bwrpnwzvjwo3op3rls3u3afavbka._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
collection
Link:
https://tria.ge/reports/230111-kbbjvabf27/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/2c458185b7132e9ddefff47aa37a1c0da2f6db354d9db73f715cb74d80a0a854

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2c458185b7132e9ddefff47aa37a1c0da2f6db354d9db73f715cb74d80a0a854

(this sample)

AgentTesla

Executable exe f2b319e1d2fdad6549ad9f56894221d7c3f8706d96012316dae1b52231a46247

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f2b319e1d2fdad6549ad9f56894221d7c3f8706d96012316dae1b52231a46247
  
Dropping
AgentTesla

Comments