MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9cee62616753e96bdcc3f9138462089f8e1f43bc7937ff7288e98c5980e2453. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 2 File information 4 Yara Comments

SHA256 hash: f9cee62616753e96bdcc3f9138462089f8e1f43bc7937ff7288e98c5980e2453
SHA3-384 hash: 7f5dc41120af32c0dcc97aab9c7f67aa78418bba3f6524732ba21276b899d3f2df7c0282febb32c25aceb9a3628eca1a
SHA1 hash: 39c17f15129531c72118936210c621d101424442
MD5 hash: 01286a3107168625edd316f65d075475
humanhash: eighteen-arizona-artist-bravo
File name:Order List_pdf.rar
Download: download sample
Signature AgentTesla
File size:221'024 bytes
First seen:2020-06-30 13:30:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:UIiI3M3aDiBjvvZ9TcSUqHcYFo5ylXf2kU68BY6znpAEDycoAQeD8+o2:U+3MqQR94qTFZffD6pA3coAJo2
TLSH F324237E56D28C1382D8E5DFAEB9FFF34CF5BB07860E44C128AF64088066461A16F61D
Reporter @abuse_ch
Tags:AgentTesla rar

Malspam distributing AgentTesla:

Sending IP:
From: Charlotte Butler <>
Subject: Re: Charlotte Butler Inquiry
Attachment: Order List_pdf.rar (contains "Order List_pdf.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 28
Origin country US US
ClamAV Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
CERT.PL MWDB Detection:n/a
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 13:32:04 UTC
AV detection:27 of 48 (56.25%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 14.75%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



rar f9cee62616753e96bdcc3f9138462089f8e1f43bc7937ff7288e98c5980e2453

(this sample)

Delivery method
Distributed via e-mail attachment