MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 136e5592b99e6ce13fd9ab06f6e93a66bdcaee9c11f232af4e68e58c9a4c4ed0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 9 File information Comments

SHA256 hash:	136e5592b99e6ce13fd9ab06f6e93a66bdcaee9c11f232af4e68e58c9a4c4ed0
SHA3-384 hash:	5d94ca08cd54191b22b06aa3d74f977cba1e48f14c189ed6c3903f8b9e4c0aea4dc9d98c20055f3b2bba4dfa2a9b7861
SHA1 hash:	0896cadc0b52cad14ac8c2bb7eac9e97a56f25f2
MD5 hash:	381ab4410128d33d7bc9d7bb502d4b7f
humanhash:	bacon-arizona-lithium-april
File name:	MOJAWA Dec Bill.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	100'941 bytes
First seen:	2025-01-17 08:38:26 UTC
Last seen:	2025-01-17 14:29:31 UTC
File type:	zip
MIME type:	application/zip
ssdeep	3072:kEFS0WAPHdPmjnwKxYWLuyQKYM063uc4Jh:j9u06+KYH6eTh
TLSH	T1EFA31267A84424BD362532AEC44CBECBCDE770EB1D9D7607FEAA10BBA72361051044D7
Magika	zip
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: "phyllis_li@thorinnovation.com < phyllis_li@thorinnovation.com >" (likely spoofed)
Received: "from thorinnovation.com (216-131-77-250.ord.as62651.net [216.131.77.250]) "
Date: "17 Jan 2025 00:19:55 -0800"
Subject: "MOJAWA Dec Bill"
Attachment: "MOJAWA Dec Bill.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

854

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	MOJAWA Dec Bill.com
File size:	237'056 bytes
SHA256 hash:	0e8ac2429ec4cf576a32961f7add923cca04237b8967f22132f93f49770cc5dd
MD5 hash:	ef23df0cd46d48a627a32b08000d3453
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.DropperX-gen.18028.14985.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678a14d24487910100dfbe9b

Tags:

phishing autorun

Result

Verdict:

Unknown

File Type:

ZIP File

Link:

https://app.docguard.net/136e5592b99e6ce13fd9ab06f6e93a66bdcaee9c11f232af4e68e58c9a4c4ed0/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated obfuscated packed packed smartassembly smart_assembly

Link:

https://www.filescan.io/uploads/678a1732b8fb56a392b982d6/reports/59afd166-f432-4760-b90d-e85635013515/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/136e5592b99e6ce13fd9ab06f6e93a66bdcaee9c11f232af4e68e58c9a4c4ed0

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/136e5592b99e6ce13fd9ab06f6e93a66bdcaee9c11f232af4e68e58c9a4c4ed0

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

100%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_SmartAssembly Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with SmartAssembly

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)