MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d04c0a34077840d5fb0c69a152d1d2ec3813a0a5c552bfde3589281cd45f7895. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 25 File information Comments

SHA256 hash:	d04c0a34077840d5fb0c69a152d1d2ec3813a0a5c552bfde3589281cd45f7895
SHA3-384 hash:	e14d71726e0f3f2292843b69ca29340460a6f4f2a4ae1f1b54f1f2d2765dba432d8eac04a41b5c815a643db470c68a17
SHA1 hash:	510cb39d7bd49a695da1d128bdd18d9f047c4249
MD5 hash:	c42c1190fd5c53022ee309633096fecf
humanhash:	fix-mango-table-video
File name:	pre-buy order PO.rar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'990'295 bytes
First seen:	2025-08-27 12:44:08 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	49152:w6qGt62+qnIwJX/OKmbY71bN0fZZIp3NbWhJqzfE:wh862+qbPmbfZZIo0fE
TLSH	T1AF9533A99DB70E56CF067873640B7ABE88650CF711DD4F90F83B5A58F8C25F26201A39
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	AgentTesla rar

cocaman

Malicious email (T1566.001)
From: "Hedi Eum, HeeSeok <hedieum@youngone.com>" (likely spoofed)
Received: "from mx1.dreamhost.com (216-131-112-239.ams.as62651.net [216.131.112.239]) "
Date: "18 Aug 2025 06:34:25 -0700"
Subject: "Bulk pre buy order"
Attachment: "pre-buy order PO.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	buy order PO.exe
File size:	1'466'432 bytes
SHA256 hash:	b4d8d2fa3c9abd1d40d80519cb058e1bb5fc2fc30448d47395dd9de1ce479a08
MD5 hash:	a1aeebf67be219f2dbf9e586ac6f63d4
MIME type:	application/x-dosexec
Signature	AgentTesla

File name:	msedge_elf.dll
File size:	3'268'096 bytes
SHA256 hash:	2d3689a4a57ad183e445b7221da670b17264aea9090dd0c9735db5ce285e2ddc
MD5 hash:	19d20f55915d9f6c5760ed14e2f8fdc3
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68aefdbdeb163e0ec182e118

Tags:

emotet virus

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context crypto fingerprint microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/68aefdb91c81c34281d5423b/reports/30763826-f1bd-4a1b-8f2a-b18d7a289487/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d04c0a34077840d5fb0c69a152d1d2ec3813a0a5c552bfde3589281cd45f7895

Verdict:

Malicious

File Type:

rar

Link:

https://opentip.kaspersky.com/d04c0a34077840d5fb0c69a152d1d2ec3813a0a5c552bfde3589281cd45f7895/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d04c0a34077840d5fb0c69a152d1d2ec3813a0a5c552bfde3589281cd45f7895/

Threat name:

Win64.Spyware.Negasteal

Status:

Malicious

First seen:

2025-08-18 02:18:09 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2bgaunahpbanl6ymngqvfuos5q4bhiffyvjl7xrvreubzvc7pckq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250827-qyz4lsz1hz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d04c0a34077840d5fb0c69a152d1d2ec3813a0a5c552bfde3589281cd45f7895

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)