MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d925a7a6906cb004451b3d9428b1c2e9c27bf8e4bea347d31a531e101033c5da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 4 Yara Comments

SHA256 hash: d925a7a6906cb004451b3d9428b1c2e9c27bf8e4bea347d31a531e101033c5da
SHA3-384 hash: 2a5934831498c3b1c61eb58ee1aac1ea6b02f84d6f58d0badabcfb4ab2063f037761775d03a7fd827f91a68ba2c86495
SHA1 hash: b6e536b00c020e0b6a4e011070feacd0cf34802c
MD5 hash: 7616631a9dcafe968d34f69c6dba4707
humanhash: quebec-finch-connecticut-lithium
File name:customer ew
Download: download sample
Signature n/a
File size:382'331 bytes
First seen:2020-06-30 13:20:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:jK3lJqU3+F16/yiRN2n/dwV1RV31N606VwtI1zgceg8dVnRludFrr6QNM1POIP6p:e3lJqIOijI/eVv6VJgPnRIdF9NM1POIo
TLSH 0884238E1F57884F47E94A7360BF6B549AA142C041320DE48321F144B79E9F7B2AAE5F
Reporter @abuse_ch
Tags:AgentTesla zip

Malspam distributing AgentTesla:

Sending IP:
From: Alex Yang <>
Subject: Customer Order
Attachment: customer ew (contains "customer ew order.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 30
Origin country FR FR
CERT.PL MWDB Detection:n/a
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 13:22:07 UTC
AV detection:14 of 48 (29.17%)
Threat level:   5/5
Spamhaus Hash Blocklist :Suspicious file
VirusTotal:Virustotal results 7.94%

File information

The table below shows additional information about this malware sample such as delivery method and external references.


zip d925a7a6906cb004451b3d9428b1c2e9c27bf8e4bea347d31a531e101033c5da

(this sample)

Delivery method
Distributed via e-mail attachment