MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5cb52f7552376d335a4f41b086eaa369c1774a9f0c1f1c57b4a25a1bfecb30a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 14
| SHA256 hash: | 5cb52f7552376d335a4f41b086eaa369c1774a9f0c1f1c57b4a25a1bfecb30a8 |
|---|---|
| SHA3-384 hash: | 985a0a64b3c800104169b2789b075327927578b1b6e49959deaaa6626bc1d19728311d853b06af5c60ff9885613985a7 |
| SHA1 hash: | f9444feef7bc47f2a4535a09544886e9bbaeb53b |
| MD5 hash: | 66447bdcfa4b82eb62d163417bf574d4 |
| humanhash: | mexico-fanta-eight-wyoming |
| File name: | 5cb52f7552376d335a4f41b086eaa369c1774a9f0c1f1c57b4a25a1bfecb30a8 |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 836'608 bytes |
| First seen: | 2025-04-08 08:08:31 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:RwjvOn6nzxcXdDHzQUNYAUh7Tzb/RCpSCMEGFuOfrtFgPHi12H3JJGZS1Tr1DJ5q:Sj2n6nGFUdrPeOyHhHnG01TrVJ5ND3U |
| Threatray | 4'697 similar samples on MalwareBazaar |
| TLSH | T1D70512688615E103C6E227B51AB5F77817AD2ECEF804E216DFDC6EEFB962E444D40342 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
378
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5cb52f7552376d335a4f41b086eaa369c1774a9f0c1f1c57b4a25a1bfecb30a8
Verdict:
Suspicious activity
Analysis date:
2025-04-07 13:20:02 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
96.5%
Tags:
virus msil
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt to an infection source
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
84 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Status:
Malicious
First seen:
2025-04-07 16:40:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
20 of 24 (83.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
unc_loader_037
Similar samples:
+ 4'687 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
discovery
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
5cb52f7552376d335a4f41b086eaa369c1774a9f0c1f1c57b4a25a1bfecb30a8
MD5 hash:
66447bdcfa4b82eb62d163417bf574d4
SHA1 hash:
f9444feef7bc47f2a4535a09544886e9bbaeb53b
SH256 hash:
9dc746f8bbcd606ea38a57c80a2f99c1890e09b8bbdeae0d57cb51152cb6bf89
MD5 hash:
cef48a687a7a3b7e7ae37b5ae0b88fa9
SHA1 hash:
0af6a534c5d386020c08ffa447c7fc9fce1e27d8
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
cf68f822581c977624b554e9669f1dacd3ea27da419ce7d922c4fd7159a37655
MD5 hash:
ef21daeeb39441e28b0cc86cc0e23235
SHA1 hash:
1297757d3382f98c8d391ee50d0dd892ab4f4440
SH256 hash:
e72dfe57e04fc5731e3692e6564ed23d6de7a30d9e08744b09965d5e62491a7a
MD5 hash:
ec5e7588f709b039c32c9f3d1919170f
SHA1 hash:
7a7a1c9d2dfb9d172c7a63be5c83fb190c2fdccb
SH256 hash:
acc3da6773f0545a3a059f0ccc233b74dc84d63d15dc2ae9c60e360013129248
MD5 hash:
f522f903bb68acf79c8f18b09f12574c
SHA1 hash:
1142a956f8fd31e8bf241277fa89aa824571617f
SH256 hash:
68053cb24ed830d902b2cee93996a2f908388c653ed5888a96517cbb6b772f49
MD5 hash:
6dd322d47ab844d598963f9bd35e16f7
SHA1 hash:
1c728d3b2a5a1bf2e1b792af4416afdd13d55908
SH256 hash:
52b50462ebe91b87e860c4450b66899cac53d93589fc97458715ee0f954a2ae5
MD5 hash:
49fb35fd4006595ce7e19cc2e2035d18
SHA1 hash:
55c3e6acb39a20978da36e967cdf9b3bff89dc16
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_DIFF_Common_Strings_01 |
|---|---|
| Author: | schmidtsz |
| Description: | Identify partial Agent Tesla strings |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.