MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b5d842d0302ffa4ddadfc2c137c28e414a4964c2be612035c64355b3c0f710f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b5d842d0302ffa4ddadfc2c137c28e414a4964c2be612035c64355b3c0f710f
SHA3-384 hash: 5c0256eea5aece0ba20386fcf821add2d16e459e0465f455ec911c36a8d8440a48349c7c5da167be7416bac5e9dbafa2
SHA1 hash: 723ffa7b49b7339129a061dcb8aa76de053b061e
MD5 hash: dd877655c5f6d8cb1a2410ad6fa2b651
humanhash: double-alaska-queen-bulldog
File name:TTRANSFER SCANCOPY 099112838377909_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'310'720 bytes
First seen:2022-08-03 11:04:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:vg6SKlpxo5ZxdtMmlUMZkrS039WbRwxpfH1/070heahF70Eo:BLlpxoVDMmOMOrSpRUdO7SeaDwp
TLSH T1D255129236FA5B23E4791FF1B920415517B0A23B2522E28D6EDE3DF31B35B130B6095B
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:AgentTesla img


Avatar
cocaman
Malicious email (T1566.001)
From: "EURO FORNITURE SRL <euroforniturepero@pec.it>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.163]) "
Date: "3 Aug 2022 11:57:29 +0200"
Subject: "Re:Transfer Comfirmation- Po 80000001893748"
Attachment: "TTRANSFER SCANCOPY 099112838377909_pdf.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
258
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.Udf.PdfExe.28447.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62ea569e0db7e64635b49cf9/reports/3a8dd02c-6308-45cb-bcca-4dedd02d2fe7/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b5d842d0302ffa4ddadfc2c137c28e414a4964c2be612035c64355b3c0f710f/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-08-03 10:31:31 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
18 of 40 (45.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tnoyilidal72jxnn7qwbg7bi4qkkjfsmfptbea24mq2vwpapoehq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b5d842d0302ffa4ddadfc2c137c28e414a4964c2be612035c64355b3c0f710f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 9b5d842d0302ffa4ddadfc2c137c28e414a4964c2be612035c64355b3c0f710f

(this sample)

AgentTesla

Executable exe 74f98be038d011db98ffd3403921bbdc2dfe67d8b67c6dc30a401a36f5e1cb8c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74f98be038d011db98ffd3403921bbdc2dfe67d8b67c6dc30a401a36f5e1cb8c
  
Dropping
AgentTesla

Comments