MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 18

Intelligence 18 IOCs YARA 19 File information Comments

SHA256 hash:	4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07
SHA3-384 hash:	0a1786f8c3e2ecce4e8439719ad9c25ab167e5d57f111c8f572a10cefa661c6fac950352e04d92b926bf9e1a35c10c9b
SHA1 hash:	516ca6c6fd417d1443dc7b326c82055f9a36b8d2
MD5 hash:	8a6431d6aab1c204f8872bf8801eb17d
humanhash:	oven-april-six-sink
File name:	SecuriteInfo.com.Win32.MalwareX-gen.24520.21282
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	207'360 bytes
First seen:	2025-05-14 09:26:58 UTC
Last seen:	2025-05-14 10:28:55 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	6144:xnX/lOF+lFuG5DzdIXdRXDhlMvM5Aj/sa:htOEn5nyXdRXEvZT
Threatray	3'341 similar samples on MalwareBazaar
TLSH	T13D14019837F8CE97E3486B31945391422230C29DAF10FB1EDD94926EFC937D82D84B95
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

432

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

GASGHGAHS.exe

Verdict:

Malicious activity

Analysis date:

2025-05-14 07:10:35 UTC

Tags:

evasion stealer ultravnc rmm-tool agenttesla

Link:

https://app.any.run/tasks/5e8cc943-3332-4813-a01a-e2c6206679ae

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.24520.21282.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682462ad4a59e5a2ce0472a9

Tags:

virus micro msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Sending a custom TCP request

Creating a window

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 crypto_obfuscator_for_net obfuscated obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/682461f8322922535cb171b4/reports/d5c2e435-6dd8-49f4-a691-ff898df07633/overview

Verdict:

Malicious

Labled as:

Marsilia.Generic

Link:

https://www.hybrid-analysis.com/sample/4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/0794284e-e10e-4dd2-b066-8556568053a6

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1689721

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-05-12 20:16:11 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

32 of 37 (86.49%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jt7exdviwyk5kxodagsxxnnbkjooisdmp7dk4qymhzx6yxzqdydq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694

AgentTesla

48b13dc5d6a66402760e4101ab8f097e12383743f4091b5701aa18f5a248afac

AgentTesla

b96cfca8ea3bc4fe132e029f2743fed9d30592d6012b4fe829180a2c1457f4f1

AgentTesla

c6f89955e03e91b02d60169829cf5655cc6a2812b570ad181677b3cc6d11fc28

AgentTesla

+ 3'331 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250514-levmkavry6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

AgentTesla

Agenttesla family

Verdict:

Suspicious

Tags:

external_ip_lookup

YARA:

n/a

Link:

https://app.threat.zone/submission/327a45fa-dc7a-49dc-b3ac-87b41364a69c

Unpacked files

SH256 hash:

4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07

MD5 hash:

8a6431d6aab1c204f8872bf8801eb17d

SHA1 hash:

516ca6c6fd417d1443dc7b326c82055f9a36b8d2

Link:

https://www.unpac.me/results/47479ad3-dab8-45c1-9646-656521b0a2c7/

SH256 hash:

7c206e760cf4344d2c6c5dff7c2e9043910559f21b6fdc3abff67f71a74b245f

MD5 hash:

e1623727c2ec4882ee639a7087926df3

SHA1 hash:

15a3e102dba09e75c9681a4696c72111feb02564

Detections:

win_agent_tesla_g2

AgentTesla

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/47479ad3-dab8-45c1-9646-656521b0a2c7/

SH256 hash:

a1870851711ec6ba57c5f9d42c611d602200bf7c8b668a0e67b6128dbb376fc5

MD5 hash:

0bb803783ca80b02779cb1bfe9213643

SHA1 hash:

4c4310a75c93747017df0c4b5117c4a2b3a92bce

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

INDICATOR_EXE_Packed_ConfuserEx

Link:

https://www.unpac.me/results/47479ad3-dab8-45c1-9646-656521b0a2c7/

Parent samples :

477b2790123de7d0c9486a1942087c05ef26bb45eea5160cd0f5411cb7797458
9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9
fc0a1ad679e97793a6fdaba06b70d49018693deeb86ae54a0a450343f511cbf0
8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea
1f17ccbd43f941b1a79412d24ad8e60f33a916d3fe73c257d65d7954313f8f5e
d56f47c995f2b7727435d6f3f4c840aa01697939fe1c228e2bbbcfa196cf2904
f7095affa7e61a334e6abdb3655ba9a801d638fc7322c649dacdd48051146f5b
4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07

SH256 hash:

bda6b3db8466b40c72979dd92126f2ff34b81d9258ce1c6d7a69aa6572d2f50b

MD5 hash:

254d3d4babfc0b4e6a0443e1e10a516d

SHA1 hash:

74544f48ec59ef064a03ae3d669253856f6a3806

Link:

https://www.unpac.me/results/47479ad3-dab8-45c1-9646-656521b0a2c7/

SH256 hash:

da7f797cf3369de47a8421a104ef85fd190949f21bfd0e09bc2604860b5e9bf7

MD5 hash:

37768cf6a39fbc378ceddda9c2047ff6

SHA1 hash:

b38bf9bf1b5a4369d726f128dfc49e80f332f1a6

Link:

https://www.unpac.me/results/47479ad3-dab8-45c1-9646-656521b0a2c7/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4cfe4b8ea8b6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe 4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3543238/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample