MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 945e9df8bb5455e99b0403cdf23f8dde8b6242fef3f26f60d61c176149fc8dfc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 945e9df8bb5455e99b0403cdf23f8dde8b6242fef3f26f60d61c176149fc8dfc
SHA3-384 hash: bc7f481fd1c8a8d6bad696db1d06df778dfd347d325f35f238692518213790fddfa7aea049e1f821d1176385e68b1a6e
SHA1 hash: b40406955050bd375abbc2cea5d919991766af9a
MD5 hash: a26867fdef5c31339cfaa4657e624419
humanhash: yankee-south-hawaii-leopard
File name:proforma invoice PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:661'151 bytes
First seen:2024-04-30 18:59:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:gABtokWiEwzUaHoMg8P1nwHLF29TBH3NkcDsV5XX/1UV0V7WxN/wu2Kkk+:foXstIh8eHLF2J/kcDsVvUV09Wk0+
TLSH T120E423362FB54B7E1288ACCB4E015CC789F6FF3558240BD92D27D190C6AD69708B61BB
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla INVOICE rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Min Nhi <Min.Nhi@chrobinson.com>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.58.228]) "
Date: "30 Apr 2024 13:29:33 +0200"
Subject: "RE:proforma invoice"
Attachment: "proforma invoice PDF.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:proforma invoice PDF.exe
File size:697'344 bytes
SHA256 hash: 7bb694bab3806b873ca20a5aab1d949e6e16eca517abcd91a197cfe7c5a3008c
MD5 hash: fd5e802efe4784f7d71201de2b486449
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/66313fb6ca951b859458e5e9/reports/207e233e-2677-466c-9065-9736d5f863a3/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/945e9df8bb5455e99b0403cdf23f8dde8b6242fef3f26f60d61c176149fc8dfc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/945e9df8bb5455e99b0403cdf23f8dde8b6242fef3f26f60d61c176149fc8dfc/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-04-30 14:14:46 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=srpj36f3krk6tgyeapg7ep4n32fweqx66pzg6ygwdqlwcsp4rx6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/945e9df8bb5455e99b0403cdf23f8dde8b6242fef3f26f60d61c176149fc8dfc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 945e9df8bb5455e99b0403cdf23f8dde8b6242fef3f26f60d61c176149fc8dfc

(this sample)

AgentTesla

Executable exe 7bb694bab3806b873ca20a5aab1d949e6e16eca517abcd91a197cfe7c5a3008c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7bb694bab3806b873ca20a5aab1d949e6e16eca517abcd91a197cfe7c5a3008c
  
Dropping
AgentTesla
  
Dropping
MD5 fd5e802efe4784f7d71201de2b486449

Comments