🀲🏼 NEW | abuse.ch Community Hub! Earn recognition πŸ… for the malware intelligence you share, climb the leaderboards πŸ“ˆ, and connect with like-minded contributors who share your hunting focus 🀝. Ready to unlock your profile? Go to the Community Hub β†’

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13b5e12ff1079a1ef0e2ea1978e04baf86473ad669d7d3145eb01fa1b6a6e75e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13b5e12ff1079a1ef0e2ea1978e04baf86473ad669d7d3145eb01fa1b6a6e75e
SHA3-384 hash: 486840c41edd736bd39c169faed6f485e044895a10b542987653ea7fa2d55ccb4560b179dfcc86d91f90867491f80191
SHA1 hash: 315da49d78d712204ea4e5023cd629988ae067e2
MD5 hash: 95ef3cde2f83a1e3d5e7c1b34ee98aa2
humanhash: bravo-nitrogen-glucose-wolfram
File name:SOA.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:688'698 bytes
First seen:2020-10-22 06:00:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:bScquV5r1bD5pDQCzG5eSWsJaK6sH2rMCbUc+E9dqDSWdTmb4i4Yeg:GTarBQasJabsWYCht9MdyUVs
TLSH 1EE4333A42E764C7F592BAE6E1F15B4B6E416B1B09F412380A4838750E3E4C59CFC8F6
Reporter abuse_ch
Tags:AgentTesla geo KOR zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: de05.enroot.cloud
Sending IP: 89.22.105.49
From: Mahesh Merugu <mahesh.merugu@epiroc.com>
Subject: RE: λŒ€λŸ‰ μ£Όλ¬Έ SOA
Attachment: SOA.zip (contains "SOA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.16579.21817.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13b5e12ff1079a1ef0e2ea1978e04baf86473ad669d7d3145eb01fa1b6a6e75e/
Threat name:
ByteCode-MSIL.Spyware.BtcWare
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 18:55:21 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=co26cl7ra6nb54hc5imxryclv6deoowwnhl5gfc6wap2dnvg45pa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 13b5e12ff1079a1ef0e2ea1978e04baf86473ad669d7d3145eb01fa1b6a6e75e

(this sample)

AgentTesla

Executable exe 5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c

  
Dropping
MD5 c785c3142fbe0e47c18403e00a94af7a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c

Comments