MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f7c9e9d4630cb82532008c0e1e0da1f21deb4bd5acb3ffd3722b36b7678c0e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 4 Yara Comments

SHA256 hash: 7f7c9e9d4630cb82532008c0e1e0da1f21deb4bd5acb3ffd3722b36b7678c0e3
SHA3-384 hash: 736ee619913ab4738d92fd522a8c6db531d34da8391c8365e9a30ec0dfd220a182d772f6f5e7ce13a46f5e3f7e7f44ef
SHA1 hash: 86d68ce6389f494ae7bf1c6d77209b7bba50818f
MD5 hash: 357b3d2d1c4361e3490e9d4933f0996a
humanhash: enemy-magazine-orange-timing
File name:swift 000394893903_06-30-2020.7z
Download: download sample
Signature AgentTesla
File size:406'184 bytes
First seen:2020-06-30 05:34:47 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:T0gXwv4kZP1Pi+PpDlEa3/Wss3bcXTxhcAbSb9re4TQ0EhhxYW7ufrWtV/kVN3A:T1XOZAC9Ga3/WzLcDxzAT5Ehz/kDA
TLSH 738423D93D741B86B90C8E1F6DBA3C94F9466D669AA489803C6098C6C0F729BCDD31C3
Reporter @abuse_ch
Tags:7z AgentTesla

Malspam distributing AgentTesla:

Sending IP:
From: Anthoni Widodo <>
Subject: Pembayaran
Attachment: swift 000394893903_06-30-2020.7z (contains "swift 000394893903_06-30-2020.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
Global Medium
# of uploads 1
# of downloads 27
Origin country US US
ClamAV No detection
CERT.PL MWDB Detection:n/a
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 05:36:04 UTC
AV detection:15 of 30 (50.00%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 14.52%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



7z 7f7c9e9d4630cb82532008c0e1e0da1f21deb4bd5acb3ffd3722b36b7678c0e3

(this sample)

Delivery method
Distributed via e-mail attachment