MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347
SHA1 hash: 2e3506619c23cd8e3859fd9357f9c37991769fe2
MD5 hash: 5d18207b79119126c746dc48f4db0960
File name:payment.
Download: download sample
Signature AgentTesla
File size:1'032'584 bytes
First seen:2020-05-22 10:08:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:WlKImBUa9FTveb3jkvW2vqOmCz5yf7S486s88sz4:WlKlDeb3YvZyPCyOLj88y4
TLSH 8225333650615EF6F22FF75E4458233F093FA023FE8691952A6F1AB6DB016C02D4CA79
Reporter @abuse_ch
Tags:AgentTesla zip

Malspam distributing AgentTesla:

Sending IP:
From: Ayman Al Kottob<>
Subject: RE:Order Prepayment _ BankCopy
Attachment: payment. (contains "payment. 4029530.iso.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
Global Medium
# of uploads 1
# of downloads 23
Origin country US US
ClamAV Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
VirusTotal:Virustotal results 21.21%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



zip 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347

(this sample)

Delivery method
Distributed via e-mail attachment