🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65
SHA3-384 hash: baecd27b077894c5d057b21de970d99bebdef219067a26e46793df8526fd0bae57ab7c448c64924f4bf6907c097be062
SHA1 hash: a476c1d6649ede0d9f08ba476ac041642e2e80bf
MD5 hash: 3d113c4be8db5b1aadaf8049f40c6c36
humanhash: cup-green-xray-july
File name:New Order PO-XNE-2025.xlam
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'556'324 bytes
First seen:2025-11-20 07:24:07 UTC
Last seen:Never
File type:Excel file xlsx
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 49152:EIiQ5o4jMGvNm4GgBTe0FGzzBAp99ltVBQeySUBMtNBzwg:FPjMOm4xBdGzzBApvVo9MtNBzwg
TLSH T1E2C53323128872A7DFA71BF30170C07734EEEBD365A89F2DB914D3E9A174CD56810A89
TrID 61.2% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7)
31.5% (.ZIP) Open Packaging Conventions container (17500/1/4)
7.2% (.ZIP) ZIP compressed archive (4000/1)
Magika xlsx
Reporter abuse_ch
Tags:AgentTesla CVE-2017-11882 xlam xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE dump

MalwareBazaar was able to identify 3 sections in this file using oledump:

Section IDSection sizeSection name
A12936975 bytesole10NatIvE
A20 bytesGZ49J6gyFQ

Intelligence

File Origin
# of uploads :
1
# of downloads :
175
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65.zip
Verdict:
No threats detected
Analysis date:
2025-11-20 07:28:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8a2cc47e-8b4e-41f5-8edc-7f893f7f0968

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
text/xml
Has a screenshot:
False
Contains macros:
False
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38789/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691ec23627c5936d7d0e0298
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for synchronization primitives
Launching a process
Sending an HTTP GET request to an infection source by exploiting the app vulnerability
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Launching a service
Changing a file
Launching a file downloaded from the Internet
Stealing user critical data
Connection attempt to an infection source by exploiting the app vulnerability
Creating a process from a recently created file
Unauthorized injection to a system process
Result
Verdict:
Malicious
File Type:
OOXML Excel File with Embedding Objects
Link:
https://app.docguard.net/6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
embedequation exploit masquerade
Link:
https://www.filescan.io/uploads/691ec22ec0cead54cd720332/reports/1b737c7f-7356-45a0-bcb7-95ef06b5dd61/overview
Verdict:
Malicious
Labled as:
CVE-2018-0798
Link:
https://www.hybrid-analysis.com/sample/6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65
Label:
Malicious
Suspicious Score:
7.1/10
Score Malicious:
72%
Score Benign:
28%
Link:
https://www.malware.ai/gui/files/?id=cea2b0f2-668b-4f69-822a-098108f482cf
Verdict:
Malicious
File Type:
xlam
First seen:
2025-11-18T20:59:00Z UTC
Last seen:
2025-11-22T04:37:00Z UTC
Hits:
~10
Detections:
Trojan-PSW.Win32.Stealer.sb Trojan-Downloader.MSOffice.SLoad.sb HEUR:Trojan-PSW.MSIL.Agensla.gen Trojan-PSW.Agensla.TCP.C&C Trojan.Win32.Agent.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agent.sb Trojan.MSIL.Crypt.sb HEUR:Exploit.MSOffice.CVE-2018-0802.gen Exploit.MSOffice.CVE-2017-11882.sb Trojan-Spy.Stealer.FTP.C&C Trojan.MSIL.Inject.sb Trojan-PSW.MSIL.Agensla.sb Trojan-PSW.MSIL.Agensla.g Trojan-PSW.MSIL.Agensla.d Trojan.MSIL.Taskun.sb HEUR:Trojan-Spy.MSIL.Agent.sb VHO:Trojan-Spy.MSIL.Quasar.gen Trojan-Spy.MSIL.KeyLogger.sb Trojan.Win32.Shelma.sb Exploit.MSOffice.CVE-2018-0802.b PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1817555
Signature
Antivirus / Scanner detection for submitted sample
Document contains OLE streams with names of living off the land binaries
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
OFFICE
Link:
https://malprob.io/report/6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65/
Verdict:
Malicious
Threat:
Trojan-PSW.MSIL.KeyLogger
Link:
https://tip.neiki.dev/file/6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65
Threat name:
Document-Office.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2025-11-19 02:07:40 UTC
File Type:
Document
Extracted files:
18
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=myrgasqk5emlx6kahdb2lvy7phzkc7ye7a4aif53vvmwnfl3z5sq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
persistence ransomware
Link:
https://tria.ge/reports/251120-h8jwdawmem/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Verdict:
Suspicious
Tags:
exploit
YARA:
INDICATOR_OLE_EXPLOIT_CVE_2017_11882_1
Link:
https://app.threat.zone/submission/6dc50181-23b3-4e27-a22f-fa27382995dc
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6622604a0ae9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6622604a0ae918bbf94038c3a5d71f79f2a17f04f8380417bbad5966957bcf65

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/38789/

Comments