MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c71b7e688d79fa6aca632f57ca33bb7bc92b95d101509d926f311466b460d362. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	c71b7e688d79fa6aca632f57ca33bb7bc92b95d101509d926f311466b460d362
SHA3-384 hash:	37196ee1fc1991471aa26a78785c33970aa7fa523a9724c0a0ae26192a521bf7a0562ff3aefe7501f1084876624ac673
SHA1 hash:	2539ea2499ee15fc4e834d46456fa94b6b3f35b6
MD5 hash:	47c6ab3db56907b61545764dbe937476
humanhash:	pennsylvania-uranus-wisconsin-floor
File name:	PO 20231615HO pdf.img
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	122'880 bytes
First seen:	2023-07-17 15:39:58 UTC
Last seen:	2023-07-17 15:41:40 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	768:bD2yZdP3SScNY8rfRqTuM+1+55emZZoHZqCyo0k4sxZO5GAwOywPXwA770X9mncF:X36G8QTugvAN50kvfZ
TLSH	T1A2C3C8D1651919D6FDAD61B2A97B8CCA25626D7F4AF0142D305FFA3243B32134207F2E
TrID	99.5% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter	cocaman
Tags:	AgentTesla img RFQ

cocaman

Malicious email (T1566.001)
From: "Cameron McCreadie <Cameron.McCreadie@prosolveproducts.com>" (likely spoofed)
Received: "from prosolveproducts.com (unknown [208.67.107.146]) "
Date: "17 Jul 2023 14:58:01 +0200"
Subject: "RFQ PO 20231615HO"
Attachment: "PO 20231615HO pdf.img"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO 20231615HO pdf.exe
File size:	71'680 bytes
SHA256 hash:	2e7065b61ad1031bb5440dc41f8a944bf08c9ef9d0f694b87cd707cbed03f242
MD5 hash:	b0bbd50fa79c09ee6c6bcdf6ac72c3bf
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Iso_badexts66.UNOFFICIAL

SecuriteInfo.com.Win32.PWSX-gen.14949.30811.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

context-iso packed

Link:

https://www.filescan.io/uploads/64b560d47a9c6ddebf0b2195/reports/fb6facf8-da98-4777-b2e2-9a751998af85/overview

Verdict:

Malicious

Labled as:

MSIL_Agent.FQK.gen

Link:

https://www.hybrid-analysis.com/sample/c71b7e688d79fa6aca632f57ca33bb7bc92b95d101509d926f311466b460d362

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c71b7e688d79fa6aca632f57ca33bb7bc92b95d101509d926f311466b460d362/

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2023-07-17 08:37:51 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

15 of 36 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y4nx42enph5gvstdf5l4um53ppesxforafij3etpgekgnnda2nra._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c71b7e688d79fa6aca632f57ca33bb7bc92b95d101509d926f311466b460d362

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research