MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0be8be9b52d735bb7df941b894cba65ab57d105f52a9bfd95448a32661ba5b90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 4 Yara Comments

SHA256 hash: 0be8be9b52d735bb7df941b894cba65ab57d105f52a9bfd95448a32661ba5b90
SHA3-384 hash: 8bffd72e790a56e0d418be3ae00eed0673a7971375bd767e78ce3911e21a5977bc1576276a8d69e8848386b8e40711fa
SHA1 hash: 2a5022062d7c6296de77254a3ffc29fb95ce64b5
MD5 hash: 13aa4cafa38d59278f59e9c4dc247bb4
humanhash: sodium-thirteen-bravo-michigan
File name:product item.Z
Download: download sample
Signature n/a
File size:388'375 bytes
First seen:2020-06-30 13:29:03 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:YrxSrnV98vSz/0vAMEOmzaq79TEVc657brYYcFTc0TeW3jsoMlhJV4UlVMY3Xtgw:YrxE99svAMEOmf7tEVDr4QO3jsllhJVR
TLSH 6F842358E7C60A93CB83EF579DFC4AEB4595983D84FE8245B19D536E28931800BC983F
Reporter @abuse_ch
Tags:AgentTesla z

Malspam distributing AgentTesla:

Sending IP:
From: Sales Manager<>
Subject: Please confirm Quote # 1-2
Attachment: product item.Z (contains "product item.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
Global High
# of uploads 1
# of downloads 30
Origin country US US
ClamAV Sanesecurity.Rogue.0hr.20200701-0811.UNOFFICIAL
CERT.PL MWDB Detection:n/a
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 10:52:53 UTC
AV detection:18 of 47 (38.30%)
Threat level:   2/5
Spamhaus Hash Blocklist :Suspicious file
VirusTotal:Virustotal results 4.92%

File information

The table below shows additional information about this malware sample such as delivery method and external references.


z 0be8be9b52d735bb7df941b894cba65ab57d105f52a9bfd95448a32661ba5b90

(this sample)

Delivery method
Distributed via e-mail attachment