MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae25aa2bf5adfbebd62e2949f955a830f3c66b189a15663855b5d0eb499febc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 4 Yara Comments

SHA256 hash: ae25aa2bf5adfbebd62e2949f955a830f3c66b189a15663855b5d0eb499febc9
SHA3-384 hash: 947321e6986ebe4fdd808bf73db1d0d31a3188c9040a7da7e3560bf08c676925520e7cdb2a1199d73cda55472a63c2da
SHA1 hash: f4a83013ebc0480cc8fcb13f90d4b91ebec9aa68
MD5 hash: 91a2f212bbd51a2ec3067a8dcd7101e2
humanhash: fanta-paris-nebraska-dakota
File name:Purchase Order No. 6095-SAP Ref. No. 587-MCS-19.GZ
Download: download sample
Signature AgentTesla
File size:413'960 bytes
First seen:2020-06-30 08:59:24 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:JBTjWK2xYM0rEGWPRB7nvTEGhD5bbFX9v:DjH2qyGcB7nIq7v
TLSH 5594236EE77A3B7505B31E021FCD8E58B31116CEF84756222A9C58E5269FDD10C28EEC
Reporter @abuse_ch
Tags:AgentTesla gz

Malspam distributing AgentTesla:

Sending IP:
From: Hit Computer - Terry <>
Reply-To: Hit <>
Subject: Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19)
Attachment: Purchase Order No. 6095-SAP Ref. No. 587-MCS-19.GZ (contains "Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19).exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 29
Origin country FR FR
ClamAV No detection
CERT.PL MWDB Detection:n/a
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 09:01:09 UTC
AV detection:18 of 48 (37.50%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 20.00%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



gz ae25aa2bf5adfbebd62e2949f955a830f3c66b189a15663855b5d0eb499febc9

(this sample)

Delivery method
Distributed via e-mail attachment