MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12ea5d0f9e00f86f3fda252e096842781986b8e24934cec912c679a9cbfe1ee0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 1 Yara Comments

SHA256 hash: 12ea5d0f9e00f86f3fda252e096842781986b8e24934cec912c679a9cbfe1ee0
SHA3-384 hash: 79a2704442c565662935e2e4efa5b75209b5c99b562f969de3bb298a63b6534d40a1131eba130c0aeba0261939dc3d2e
SHA1 hash: e601a22c86f8dc55397cd744e9b0b8a836219f08
MD5 hash: 6faa216786fbd25ac72aebc1cd53f43a
humanhash: oklahoma-quebec-salami-south
File name:E_REQ_389-RS215035.pdf.rar
Download: download sample
Signature AgentTesla
File size:373'520 bytes
First seen:2020-06-30 06:33:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:BuRvO5LKh00NXUh9z238KxcuuYrGLsePZFvtNFj8dd6GpqHXuW7r7:BuxO5LSQnzMrKhbF/jkdxpaesr7
TLSH 5D84238090DC13CCA30720919A05F83A265BA3B6F42FD56D786FE28169F7BBDE047D56
Reporter @jarumlus


Mail intelligence
Trap location Impact
CH Switzerland Low
Global Medium
# of uploads 1
# of downloads 30
Origin country US US
ClamAV No detection
CERT.PL MWDB Detection:n/a
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 06:35:06 UTC
AV detection:16 of 30 (53.33%)
Threat level:   2/5
Spamhaus Hash Blocklist :Suspicious file
VirusTotal:Virustotal results 12.90%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



rar 12ea5d0f9e00f86f3fda252e096842781986b8e24934cec912c679a9cbfe1ee0

(this sample)

Delivery method
Distributed via e-mail attachment