MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f
SHA3-384 hash: aa7d4f461e89c7de68f615a8bcd8ceb0f6e01d88cc51dfbfb221f765aa8de57b118c390a9aa4b30bc2ff5c98e8f24c0b
SHA1 hash: 9a883a02392bfd43d737a842bde2378a3be20892
MD5 hash: a69c7333ced410800e65c89919486541
humanhash: high-robert-shade-six
File name:PAYMENT_COPY.PDF,.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'024'000 bytes
First seen:2026-07-20 16:15:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'122 x AgentTesla, 20'134 x Formbook, 12'360 x SnakeKeylogger)
ssdeep 24576:A1j/Og3ieBgi9UkzKyXuJX+QrY5Zl5Yv9CCGu7D/S3E:oPyeBgi99zKQArYV5EMo7D/S3
TLSH T11C25125877ABDE02C2B607B009F1E17043B51E49E433D24B0ED9ADDB3A62B968DD4B53
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
229
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
NETReactor RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d01f10a4-ffb3-4336-b453-bbe11a3a3dff/
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75452/
Detection(s):
SecuriteInfo.com.Trojan.Siggen33.1095.84944874.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5e49e1bcffb2c48cb7a297
Tags:
virus spawn lien msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a service
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 dropper masquerade net_reactor obfuscated packed packed
Link:
https://www.filescan.io/uploads/6a5e49dd38b016479f49952e/reports/4b85b1dc-7646-462b-9a19-30ee8ccca8e2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-20T08:20:00Z UTC
Last seen:
2026-07-22T10:59:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/20e5f65e-9089-40dd-b92d-d04fa9d8dad1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1945351
Signature
.NET source code contains potential unpacker
AI detected malicious Powershell script
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Powershell decode and execute
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1945351 Sample: PAYMENT_COPY.PDF,.exe Startdate: 20/07/2026 Architecture: WINDOWS Score: 100 45 server39.web-hosting.com 2->45 47 mr-b01.tm-azurefd.net 2->47 49 2 other IPs or domains 2->49 61 Found malware configuration 2->61 63 Malicious sample detected (through community Yara rule) 2->63 65 Antivirus / Scanner detection for submitted sample 2->65 67 16 other signatures 2->67 8 PAYMENT_COPY.PDF,.exe 1 6 2->8         started        12 powershell.exe 19 2->12         started        14 powershell.exe 2->14         started        signatures3 process4 file5 35 C:\Users\user\AppData\Roaming\BYmegc.exe, PE32 8->35 dropped 37 C:\Users\user\...\BYmegc.exe:Zone.Identifier, ASCII 8->37 dropped 39 C:\Users\user\AppData\...\11xfeim0r3w.ps1, ASCII 8->39 dropped 41 C:\Users\user\...\PAYMENT_COPY.PDF,.exe.log, ASCII 8->41 dropped 69 Creates autostart registry keys with suspicious values (likely registry only malware) 8->69 71 Creates an autostart registry key pointing to binary in C:\Windows 8->71 16 MSBuild.exe 2 8->16         started        20 BYmegc.exe 3 12->20         started        22 conhost.exe 12->22         started        24 BYmegc.exe 2 14->24         started        26 conhost.exe 14->26         started        signatures6 process7 dnsIp8 43 server39.web-hosting.com 198.187.29.124, 49761, 49766, 49767 NAMECHEAP-NET-NamecheapIncUS United States 16->43 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->51 53 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->53 55 Tries to steal Mail credentials (via file / registry access) 16->55 57 Antivirus detection for dropped file 20->57 59 Multi AV Scanner detection for dropped file 20->59 28 MSBuild.exe 2 20->28         started        31 MSBuild.exe 20->31         started        33 MSBuild.exe 24->33         started        signatures9 process10 signatures11 73 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 33->73 75 Tries to steal Mail credentials (via file / registry access) 33->75 77 Tries to harvest and steal ftp login credentials 33->77 79 Tries to harvest and steal browser information (history, passwords, etc) 33->79
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-07-20 11:32:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
25 of 38 (65.79%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jubtxa5oyzjzbrwzb6oyoisp3xj3zvliz5eq3hoafo5q67nq2whq._file
Verdict:
malicious
Label(s):
AgentTesla
Create hunting rule
Link:
https://reports.threatray.com/702aa530-cb61-448e-b822-9b42617054cd
Similar samples:
31dd3e8d2700af11c4a5e14defb93a8ef1891f8801d6e8bc5ed35e106a072e64
AgentTesla
56e0cfc0fb789f7d8d7cef0b8497eef95563f46bb383d5f38061347657eaa445
AgentTesla
6d9b7e45f0ac13266800021b0ed41d95a69746f2596511680223525bb1fde745
AgentTesla
8163363141e4466928fdeb219fda2d099ac4d55c5e0b7a626e53300511d0ce8a
AgentTesla
87c9b23d3ac3e48910f9d204708f95d337fab4161b5fc8a9a32735cfe7b8d83d
AgentTesla
a89d88037e6e7321b7da02290aab0139ddf7be1b697388dcc28fba708304682f
AgentTesla
eb87b3dc43401ecf721197d64f818cd03e9283f04d02eb2ca4680c3356f29fcf
AgentTesla
f11026574c1ad05a8eb43f8a267b8dc11ce7f981f32a4c72f0675e6141e898f4
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260720-tqxkasfz5j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f
MD5 hash:
a69c7333ced410800e65c89919486541
SHA1 hash:
9a883a02392bfd43d737a842bde2378a3be20892
Link:
https://www.unpac.me/results/221b3824-6741-4e75-ba0f-7eca5d11b0e2/
SH256 hash:
0ce4ffff46527f093518992a9d60d67571e4d633c6844b7c9bd72f6f8ce3f0af
MD5 hash:
1bd5a5b472b56c97cc73f15da86e58a8
SHA1 hash:
27d8579757bce067782686ed3a50192774c5985e
Link:
https://www.unpac.me/results/221b3824-6741-4e75-ba0f-7eca5d11b0e2/
SH256 hash:
01ff3e706f0f3928207b5e020eebb9ed38428dfbbf0f8c46aeec328b73519160
MD5 hash:
bbb0d2ca9a21d5a1f6c9059e108ea3ee
SHA1 hash:
5accd45f4a70a26b6ce07e04cc3820e99187a818
Link:
https://www.unpac.me/results/221b3824-6741-4e75-ba0f-7eca5d11b0e2/
SH256 hash:
c5b5795faa79b8afae66cf7bd6780565d6552076922faf36f953b4f3efebc020
MD5 hash:
b0c38eb7c9e295d195b079b81d6e1390
SHA1 hash:
7cba5263bc34ef84bcb72d6bfda1bd051bbcc8b6
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/221b3824-6741-4e75-ba0f-7eca5d11b0e2/
Parent samples :
8dbd16903437126bd14983912aac07748f95289da274c04f5f4a6610e77bfd9c
4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f
6dc941968b3bc93e3f5709972f0ce23395eb65465fa23ddd68b8cb6ca52ddd0c
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4d033b83aec6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 4d033b83aec65390c6d90f9d87224fddd3bcd568cf490d9dc02bbb0f7db0d58f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/75452/

Comments