MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce42838b6e07e77e81fa53922150cc3225de9d76b09c3a9bc611be1cf4b58579. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 5

Intelligence 5 IOCs YARA 26 File information Comments

SHA256 hash:	ce42838b6e07e77e81fa53922150cc3225de9d76b09c3a9bc611be1cf4b58579
SHA3-384 hash:	8f658c5d29747413dbab62934a2fce5e27ce9f8cf451bacf2ad5c360c9db6df99e518a49455bbcf365c89a15a9fcc9a2
SHA1 hash:	7ab3520282b601fe4f1c0b87979ab409bd3fe8c7
MD5 hash:	d0e1497503a089a9be829b9cf4b4057f
humanhash:	lactose-double-nitrogen-six
File name:	PO PROCESSED CONFIRMATION.tar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'811'418 bytes
First seen:	2025-09-18 11:04:34 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-rar
ssdeep	49152:X9xjvoFPo2GX+VLavvd/zBX70jAu8SiK2AVh9xH2:vDWPnG2a/zqAuFi72h9xH2
TLSH	T1928533DEE622CF2CF749ABBB81113D938EB2E63519868C9F15A94B1426D77C00F4746C
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	tar

cocaman

Malicious email (T1566.001)
From: "purchase@rbe.net.in" (likely spoofed)
Received: "from mx1.dreamhost.com (216-131-112-121.ams.as62651.net [216.131.112.121]) "
Date: "16 Sep 2025 10:23:55 -0700"
Subject: "PO PROCESSED CONFIRMATION"
Attachment: "PO PROCESSED CONFIRMATION.tar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	1PO PROCESSED CONFIRMATION.exe
File size:	1'530'432 bytes
SHA256 hash:	c2fd821a5c7aaf5cc463fd891d2376541a1daa0826753b4e370ec41368db219d
MD5 hash:	073bfcf6675c652eec44c847621c2cc2
MIME type:	application/x-dosexec
Signature	AgentTesla

File name:	msedge_elf.dll
File size:	2'723'840 bytes
SHA256 hash:	7b3d435d322d7303446c5ce3308704a1d4d5a5b1e70abb44a19502be6baf2c79
MD5 hash:	c807a235099bb0ea25cf41d1ea5b4c24
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ca561ed49ea3f1e4b6c882

Tags:

n/a

Verdict:

Unknown

Threat level:

n/a -.1.0/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm explorer fingerprint lolbin microsoft_visual_cc signed

Link:

https://www.filescan.io/uploads/68cbe754c62f6996238b1b31/reports/c635c50c-e8e7-415b-ac62-05da7ff1a441/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ce42838b6e07e77e81fa53922150cc3225de9d76b09c3a9bc611be1cf4b58579

Verdict:

Malicious

File Type:

rar

First seen:

2025-09-16T01:04:00Z UTC

Last seen:

2025-09-16T01:04:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ce42838b6e07e77e81fa53922150cc3225de9d76b09c3a9bc611be1cf4b58579/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Rar Archive

Link:

https://app.malva.re/file/d0e1497503a089a9be829b9cf4b4057f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce42838b6e07e77e81fa53922150cc3225de9d76b09c3a9bc611be1cf4b58579/

Threat name:

Win64.Spyware.Negasteal

Status:

Malicious

First seen:

2025-09-16 03:11:24 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zzbihc3oa7tx5ap2kojccugmgis55hlwwcodvg6gcg7bz5fvqv4q._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250918-nn71cszp15/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ce42838b6e07e77e81fa53922150cc3225de9d76b09c3a9bc611be1cf4b58579

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	Jupyter_infostealer Create hunting rule
Author:	CD_R0M_
Description:	Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)