MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 20


Intelligence 20 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
SHA3-384 hash: c3a31ceac5ddc00f066c06a710a6cfd8e8bc591bb451e25224695fbeaf24fd82f062f6a01e3816e1335f426379a6b903
SHA1 hash: 54bf1e80e48f5dc682063f99a8093c1dbc164452
MD5 hash: 86d31c665d2a3222c663bd9e6a2d5dc1
humanhash: rugby-lima-river-echo
File name:Ordine di acquisto_(PO_109228)_doc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'270'246 bytes
First seen:2025-10-02 11:27:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e92b2275a730f59940462780c383a1b0 (26 x CryptOne, 3 x Loki, 2 x Mimic)
ssdeep 24576:hdZKo0Y/Sqk/Eio4G9v1UCi5IIzkpzAWnzNTpUcL9J8WtKZJ:hTK4SbXmS7IIz9oBdVP8v
Threatray 180 similar samples on MalwareBazaar
TLSH T1DA450226B1C08171E5E36938D9E9AB30A77B3D33CB3589CF9354762D2A315C19931BA3
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10522/11/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4504/4/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter JAMESWT_WT
Tags:AgentTesla bot6670375909 exe Lokibot PO109228 Spam-ITA

Intelligence

File Origin
# of uploads :
1
# of downloads :
328
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
lokibot
Create hunting rule
ID:
1
File name:
Ordine di acquisto_(PO_109228)_doc.exe
Verdict:
Malicious activity
Analysis date:
2025-10-02 11:28:14 UTC
Tags:
lokibot stealer evasion trojan telegram exfiltration agenttesla qrcode ims-api generic
Link:
https://app.any.run/tasks/5304e07a-8b27-478d-887c-951bbf9e5207

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/29912/
Detection(s):
Win.Malware.Fugrafa-9934740-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68de61b9b54520161ad45aed
Tags:
underscore virus sage msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Launching a service
Creating a process from a recently created file
Launching a process
Reading critical registry keys
Changing a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP POST request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Sending a custom TCP request
Unauthorized injection to a recently created process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-01T07:31:00Z UTC
Last seen:
2025-10-04T07:18:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a/results?tab=lookup
Malware family:
NetWire RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e314499a-5efe-426c-b1ac-1951f6c38da9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
Threat name:
Win32.Infostealer.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2025-10-01 17:03:36 UTC
File Type:
PE (Exe)
Extracted files:
114
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m2fuc5tfpwh7b5gzyjkz2x6ize5zdrzpx3wshc2zqp4uxecvvy5a._file
Verdict:
malicious
Label(s):
lokipasswordstealer(pws)
Create hunting rule
zgrat
Create hunting rule
agenttesla
Create hunting rule
unc_loader_051
Create hunting rule
Similar samples:
48267b826fa7ec0cea8be878f979a967d0a091cccea9f226ad8d87b29dc94800
AgentTesla
668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
AgentTesla
c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b
AgentTesla
e40f9ff3dda096f79746566f7a3d596dc596abb064cd639fa5534248884afd7f
AgentTesla
ecf728bccb42e68665e0e9bc2759862a4ab385384ff4f35ef185fc1aeef174ca
AgentTesla
error
AgentTesla
+ 170 additional samples on MalwareBazaar
Result
Malware family:
lokibot
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:lokibot adware collection discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/251002-nkymhsbr6v/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
ConfuserEx .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
AgentTesla
Agenttesla family
Lokibot
Lokibot family
Malware Config
C2 Extraction:
https://api.telegram.org/bot6670375909:AAF4GVzfhy3KyMMlBfsyRBAGBlEBJIbvDgs/
http://montblancgroup.cfd/New/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Verdict:
Malicious
Tags:
Win.Malware.Fugrafa-9934740-0
YARA:
n/a
Link:
https://app.threat.zone/submission/edc6fcb9-b93c-4d1c-a68e-a65da318dc29
Unpacked files
SH256 hash:
668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
MD5 hash:
86d31c665d2a3222c663bd9e6a2d5dc1
SHA1 hash:
54bf1e80e48f5dc682063f99a8093c1dbc164452
Link:
https://www.unpac.me/results/5728054f-e06e-45a6-960d-f7b8f7414cef/
SH256 hash:
5aa774e9545c8b8ce704219aeb374be885ec8533eaa8562db4ad5118917582be
MD5 hash:
bfd948b8b91e56b10c2aab1f9f11358a
SHA1 hash:
65049106999cc5351c73c3a738f40417f7bc8fd0
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/5728054f-e06e-45a6-960d-f7b8f7414cef/
Parent samples :
668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
5aa774e9545c8b8ce704219aeb374be885ec8533eaa8562db4ad5118917582be
e8d4cd03450bee6fa32028e4e4e0e415d4c4bbfcb349e77170cd983226666820
SH256 hash:
3d47a30d3dc45a53ba3ff4fc5fcb3ccdb8f3b1bda3d7f8e6c3e50d268ac7a3a4
MD5 hash:
c3a3da9034c1a9641dd540a35cd49ff6
SHA1 hash:
14316522d02782733aa8226643b3798e3209991f
Link:
https://www.unpac.me/results/5728054f-e06e-45a6-960d-f7b8f7414cef/
SH256 hash:
20a7b7fa27a8a3d79e7e124e1f0ce2ca2a647f432740565d2935badd84814027
MD5 hash:
bdbfc8de76d50d05a2dba4c515a50b90
SHA1 hash:
cac80a2c292d015d7c980724e9391b88d60f0f76
Detections:
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Link:
https://www.unpac.me/results/5728054f-e06e-45a6-960d-f7b8f7414cef/
Parent samples :
088bb7500d35c7ab73827301e505660559437479ef46312c3ee08b6253f35953
8b5e4c846dc98bdea2524651cf2895630c27bab15f5b27d60a9fd732b1c6ba3f
75173e92fd7a13e7be3ec177c5287280aae4d2a5e6911cd1458400d96289d18d
7cfbe6d3f41c153c78f4e24211ffd891cde46411f072d83798e0e03e140a7021
83f31c20b1e1819627874ca9eeb2a8b703e28656a581289821415963dcf596b8
d59042fb9666d5a2fcb62371be2ab5c51b708f27db5711659d6b6d54e261741e
ee8578ebf209462c50f37d8fceb524db53b5b97078aa0995c775133b8d3f9d64
62ad3f54c6adf2f358213da7c9729890d86d1f17444f23d159aa6455188b34bc
1d723e459d4edcfdba3c63825c9582341d356b22ecfc22b8a446b430e0b27be5
141a6b48b260182bfbf3419b85b4d63d06a9bc41dd8ac573528c74c980b01614
668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
5aa774e9545c8b8ce704219aeb374be885ec8533eaa8562db4ad5118917582be
e8d4cd03450bee6fa32028e4e4e0e415d4c4bbfcb349e77170cd983226666820
SH256 hash:
2c62f166de24a6f88d924d852e32788743e60ba58f9a920437e4fd8f2b6d7e1c
MD5 hash:
004c51ceda9f9242314ef389df97633c
SHA1 hash:
faba88b7fb17889ae6a72d39c5a9805be4a50c8c
Detections:
win_agent_tesla_bytecodes_sep_2023
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
Link:
https://www.unpac.me/results/5728054f-e06e-45a6-960d-f7b8f7414cef/
SH256 hash:
f19c0ac892bc18f53706ce5a5d9fbb09c7eee837e0590b550e8b6588a3a6db66
MD5 hash:
3e1522d238b2ed6e1e1e6a210dd9b676
SHA1 hash:
0fe2d8b9c0560f313778e881cbf901146c5beb3c
Link:
https://www.unpac.me/results/5728054f-e06e-45a6-960d-f7b8f7414cef/
SH256 hash:
47e2bd28e93c047783c899c3f76765ddb263b3062f50a55c11d32fc354b15c6b
MD5 hash:
35ab576d4acd0143eb46496dff6b5510
SHA1 hash:
b766154ec0ac6f8b1b23615954237be6b5cc4284
Detections:
win_lokipws_g0
Create hunting rule
win_lokipws_auto
Create hunting rule
lokibot
Create hunting rule
STEALER_Lokibot
Create hunting rule
SUSP_XORed_URL_In_EXE
Create hunting rule
Lokibot
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Link:
https://www.unpac.me/results/5728054f-e06e-45a6-960d-f7b8f7414cef/
Parent samples :
668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a
5aa774e9545c8b8ce704219aeb374be885ec8533eaa8562db4ad5118917582be
47e2bd28e93c047783c899c3f76765ddb263b3062f50a55c11d32fc354b15c6b
e8d4cd03450bee6fa32028e4e4e0e415d4c4bbfcb349e77170cd983226666820
Malware family:
zgRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/668b4176657d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AlphaCrypt
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/668b4176657d8ff0f4d9c2559d5fc8c93b91c72fbeed238b5983f94b9055ae3a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/29912/

Comments