🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af
SHA3-384 hash: d3d687aacfcc5a2b6ab568952fe2da85916a1199bf7aa38916ab5f97a012bfdb1c11581421ba5e743a50a7ff94c092a9
SHA1 hash: e9c23bddf4d8ea3e137f3b5ae9f9442e47ed8973
MD5 hash: 0b21737d71e755e6408ba5e5fa587e38
humanhash: virginia-freddie-green-fix
File name:copia de factura.bat
Download: download sample
Signature AgentTesla
Create hunting rule
File size:57'817 bytes
First seen:2026-04-28 07:05:36 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 1536:Cq9RCQPzRrfpxKKet2Z+9SI1XFallxRe6PE+bhHyj:PRCzKeoZ+9SOXFH6PE+bhHyj
Threatray 3'462 similar samples on MalwareBazaar
TLSH T14343C02729CBC87608F0851EAB19374BF71CE4F55B48E5DC114A92DE201CD6FCA87B9A
Magika batch
Reporter lowmal3
Tags:AgentTesla bat

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a91a9914-fbb9-4b4d-9251-7bdc5015a06e/
Malware family:
n/a
ID:
1
File name:
_68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af.txt
Verdict:
No threats detected
Analysis date:
2026-04-28 07:09:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4ff314e6-2ed9-4e00-8790-f3096e709171

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63839/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aes base64 base64 crypto evasive masquerade obfuscated packed powershell
Link:
https://www.filescan.io/uploads/69f05c4d8a82359247b6f419/reports/42f24658-126f-4327-9b5c-9a80b083fb94/overview
Verdict:
Suspicious
Labled as:
BAT/Obfuscated.AR trojan
Link:
https://www.hybrid-analysis.com/sample/68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-04-27T12:01:00Z UTC
Last seen:
2026-04-30T02:59:00Z UTC
Hits:
~1000
Detections:
HEUR:Trojan.BAT.Obfus.gen Trojan.BAT.Agent.sb
Link:
https://opentip.kaspersky.com/68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af/results?tab=lookup
Result
Threat name:
AgentTesla, XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1905503
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Renames powershell.exe to bypass HIPS
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Powershell decode and execute
Yara detected UAC Bypass using CMSTP
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1905503 Sample: copia de factura.bat Startdate: 28/04/2026 Architecture: WINDOWS Score: 100 54 keyauth.win 2->54 56 ip-api.com 2->56 70 Suricata IDS alerts for network traffic 2->70 72 Found malware configuration 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 19 other signatures 2->76 9 cmd.exe 1 2->9         started        12 OpenWith.exe 19 8 2->12         started        signatures3 process4 signatures5 92 Suspicious powershell command line found 9->92 94 Bypasses PowerShell execution policy 9->94 14 powershell.exe 17 25 9->14         started        19 conhost.exe 9->19         started        process6 dnsIp7 58 203.202.232.149, 2222, 49693 ACCESSSMART-ASAccessSmartSolutionsIndiaPvtLtdIN India 14->58 60 ip-api.com 208.95.112.1, 49694, 49695, 49696 TUT-ASUS United States 14->60 48 C:\Users\user\AppData\Roaming\...\Update.db, PE32+ 14->48 dropped 50 C:\Users\user\AppData\Local\Temp\wcgobt.exe, PE32 14->50 dropped 52 C:\Users\user\AppData\Local\Temp\iebwoo.exe, PE32 14->52 dropped 62 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->62 64 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->64 66 Tries to steal Mail credentials (via file / registry access) 14->66 68 5 other signatures 14->68 21 wcgobt.exe 14->21         started        24 iebwoo.exe 14->24         started        26 powershell.exe 23 14->26         started        28 7 other processes 14->28 file8 signatures9 process10 file11 78 Antivirus detection for dropped file 21->78 80 Multi AV Scanner detection for dropped file 21->80 82 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->82 84 Injects a PE file into a foreign processes 21->84 31 wcgobt.exe 21->31         started        34 wcgobt.exe 21->34         started        86 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 24->86 88 Tries to steal Mail credentials (via file / registry access) 24->88 90 Loading BitLocker PowerShell Module 26->90 36 conhost.exe 26->36         started        46 C:\Users\user\AppData\...\powershell.exe, PE32 28->46 dropped 38 conhost.exe 28->38         started        40 conhost.exe 28->40         started        42 conhost.exe 28->42         started        44 4 other processes 28->44 signatures12 process13 signatures14 96 Tries to steal Mail credentials (via file / registry access) 31->96 98 Tries to harvest and steal browser information (history, passwords, etc) 31->98
Score:
72%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af
Threat name:
Script-BAT.Trojan.XWorm
Create hunting rule
Status:
Malicious
First seen:
2026-04-27 18:19:25 UTC
AV detection:
2 of 38 (5.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ndfs5v6n6et3da4hf5oxy5f5rsqs646ggo3ujllf4fp6wwvjesxq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
153c5641badc8df2740041f4dcbceb18fed6560af9fb704776304c96c9974bcf
AgentTesla
24d5c728af9ea56d4148f0d00e443db04621415c3730ab68b6ad8b8b3ec534bf
AgentTesla
3ed8d3644585e7a3c4e49ccb716e72950349d35144e912d7e9bc4b810abe62ac
AgentTesla
5f6e7232d0fd57d8b46e8fbd1f7c917b4bddb4c426b9ea7d73e1276a197ca84d
AgentTesla
878c2fd49c39b041dcd87701bfa3d32362103e2411a5310e74d1fc878f310c67
AgentTesla
dd571605c43f67c667cf409ddffd8fadbe022d45239f7aa61e584f0c2cd274f4
AgentTesla
dd5f4cf43236b8b7c89369b8a42cf5917f41c88a5d3d785d596058f2b203ac72
AgentTesla
ec145d51cb891b1e9a1e31088c0803371b5804baee1e766016b0a6f6e471f385
AgentTesla
error
AgentTesla
f4073f71a9d0616905a018e6f42c60530ffaad1cba3f1057d3f47b82fa3f90e5
AgentTesla
+ 3'452 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:xworm collection discovery execution keylogger rat spyware stealer trojan
Link:
https://tria.ge/reports/260428-hyqwyaet61/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: AgentTesla
Family: Xworm
Malware Config
C2 Extraction:
203.202.232.149:2222
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/68cb2ed7cdf1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:obfuscated_BAT
Create hunting rule
Author:@warz_s
Description:Identifies obfuscated BAT files
Reference:https://github.com/secwarz/YaraRules
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Batch (bat) bat 68cb2ed7cdf127b183872f5d7c74bd8ca12f73c633b744ad65e15feb5aa924af

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/63839/

Comments