MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc
SHA3-384 hash: 91dc15ec42f9050105471b32f9e7a3ea97ed56941aa079454185504bb91160067fda07a7e56184c47b4f31fbf2049c55
SHA1 hash: 6302daa0321aed1964ab6540bae931accfe38735
MD5 hash: 9291840e8b572522aa94b80b2c125f0a
humanhash: arizona-six-triple-solar
File name:Draft Documents_TTF2510169.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:626'445 bytes
First seen:2025-11-06 09:35:17 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:dmZdIY+bjMR/Gn7NBHuLlrn4J60NHl3DlFHJbC0dpeJV6VK0hE923S3+canIyirj:deCbjqaNBOqNHjFHth+8IFOcaIy2JRH
TLSH T14CD4234ED6FC8977187895453175F88CC9E560EC144E33F60972AD93E2888F814AECEC
Magika gzip
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Nina Dang <export@quantumcircuits.it.com>" (likely spoofed)
Received: "from mail.quantumcircuits.it.com (mail.quantumcircuits.it.com [172.245.88.80]) "
Date: "Thu, 06 Nov 2025 06:31:23 +0100"
Subject: "Draft document TTF2510169"
Attachment: "Draft Documents_TTF2510169.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Draft Documents_TTF2510169.exe
File size:695'808 bytes
SHA256 hash: 3d60993b1ca1c6786c9c2fe6c6b7c2574fcfa5e28101181f7c29c6c5ddf54c37
MD5 hash: 56a64401bd7aa078fbdf5ca306b2d535
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c6bdd5a5ed7864e236b6c
Tags:
virus micro msil
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated obfuscated packed
Link:
https://www.filescan.io/uploads/690c6bda85b61a93a73b2a9a/reports/984981bc-814d-4a1a-a088-0e38eccb85e8/overview
Verdict:
Malicious
Labled as:
Trojan.Wacatac
Link:
https://www.hybrid-analysis.com/sample/52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc
Verdict:
Malicious
File Type:
gz
First seen:
2025-11-06T06:39:00Z UTC
Last seen:
2025-11-07T14:45:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
.Net Executable GZip Archive Managed .NET PE (Portable Executable) PE File Layout SOS: 0.67
Link:
https://app.malva.re/file/9291840e8b572522aa94b80b2c125f0a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc
Threat name:
ByteCode-MSIL.Trojan.InfostealerTesla
Create hunting rule
Status:
Malicious
First seen:
2025-11-06 06:09:35 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ki3a6fdwkxgzsll7ghmbrm2ht4jbejweolnpwuenrxqu4yf5ac6a._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/251106-mf6xnavnbr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Agenttesla family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 52360f147655cd992d7f31d818b3479f121226c472dafb508d8de14e60bd00bc

(this sample)

AgentTesla

Executable exe 3d60993b1ca1c6786c9c2fe6c6b7c2574fcfa5e28101181f7c29c6c5ddf54c37

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d60993b1ca1c6786c9c2fe6c6b7c2574fcfa5e28101181f7c29c6c5ddf54c37
  
Dropping
MD5 56a64401bd7aa078fbdf5ca306b2d535

Comments