MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 398326880d507f3c7731113a7c2630e01df8a3013422346c12e55d5ab76efd19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 2 Yara Comments

SHA256 hash: 398326880d507f3c7731113a7c2630e01df8a3013422346c12e55d5ab76efd19
SHA3-384 hash: f67f39eb81109288cd493ce88451c4d89d9c2a27f77969700a102e1d6f602e9c6b08e1e60240070ba6e430481c76beef
SHA1 hash: 090e7ec176ae4332665bb35b6c52af3a18f1fa43
MD5 hash: b72502adc492cd694cd064d56a93fed5
humanhash: artist-uniform-arkansas-sodium
File name:doQsVLzQv.exe
Download: download sample
Signature AgentTesla
File size:798'208 bytes
First seen:2020-03-23 16:17:08 UTC
Last seen:2020-03-23 16:17:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:brGF/nCL0bI7vhw0VROLN8JLERmZIYXEKPIU1hoeYCCn2+mU6Hb9pbnimsnYHMe:dLvVcxULMmH0qZY3iUU9Vimt
TLSH F5056AC0EE67EA19C16816F0C94DD108C3A4EF496741EE406E86F3DA657270DCDE8AF6
Reporter @HerbieZimmerman
Tags:Agent Telsa AgentTesla RAT


Mail intelligence
Trap location Impact
IT Italy Low
CH Switzerland Low
Global Low
NL Netherlands Low
# of uploads 2
# of downloads 25
Origin country US US
ClamAV No detection
CERT.PL MWDB Gathering data
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-03-23 19:50:14 UTC
AV detection:25 of 30 (83.33%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 13.89%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 398326880d507f3c7731113a7c2630e01df8a3013422346c12e55d5ab76efd19

(this sample)

Delivery method
Distributed via e-mail attachment