MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2
SHA3-384 hash: 4ab9162c26a015c5324dd7078ea871be9e08ab5193d85d98f0f6dde2c16cddc7d17eba78d4639b87873c2a89e5678001
SHA1 hash: 627f8bddcf0920192be0e9127d88da08a281e7d5
MD5 hash: e3fdf3857135e0f078bec72efcebfdf9
humanhash: wyoming-white-tennessee-sierra
File name:TEKLİF TALEP VE FİYAT LİSTESİ_xlsx.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:567'296 bytes
First seen:2025-04-28 09:36:58 UTC
Last seen:2025-05-09 14:33:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ef471c0edf1877cd5a881a6a8bf647b9 (83 x Formbook, 33 x Loki, 31 x Loda)
ssdeep 12288:/Ov5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi2z96kZyJfkZxzk4FrHXIo7pL:/q5TfcdHj4fmb1z3ZbxQEHYo9L
Threatray 1'661 similar samples on MalwareBazaar
TLSH T137C423E1BD9C8CB3F9753AB2E0792F832A7F8F4198651B450DE97A418873A6315C523C
TrID 33.9% (.EXE) UPX compressed Win32 Executable (27066/9/6)
33.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
13.1% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 4f89090c0c098d4f (21 x AgentTesla, 8 x MassLogger, 1 x VIPKeylogger)
Reporter threatcat_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
529
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
TEKLFTALEPVEFYATLSTES_xlsx.exe
Verdict:
Malicious activity
Analysis date:
2025-04-28 09:40:19 UTC
Tags:
evasion stealer ultravnc rmm-tool auto-startup agenttesla
Link:
https://app.any.run/tasks/d87dae86-ee90-491f-98c6-45a9af87820b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/4704/
Detection(s):
SecuriteInfo.com.AutoIt.Agent-AOQ.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.W32.Trojan.VORE-2106.1542.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=680f4d02cc5fb3600cc3d6da
Tags:
underscore autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Sending a custom TCP request
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
autoit compiled-script entropy masquerade microsoft_visual_cc obfuscated overlay packed packed packed packer_detected upx virtual
Link:
https://www.filescan.io/uploads/680f4c4846fe05453ca8abc5/reports/8e8beb1f-7b96-4d11-b791-624fd334a455/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/fdeafada-3383-4091-968e-bf5869d94864
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1676147
Signature
Binary is likely a compiled AutoIt script file
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Drops VBS files to the startup folder
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Drops script at startup location
Sigma detected: WScript or CScript Dropper
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1676147 Sample: TEKL#U0130F TALEP VE F#U013... Startdate: 28/04/2025 Architecture: WINDOWS Score: 100 30 us2.smtp.mailhostbox.com 2->30 32 smtp.infroyale.com 2->32 34 ip-api.com 2->34 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 7 other signatures 2->46 8 TEKL#U0130F TALEP VE F#U0130YAT L#U0130STES#U0130_xlsx.exe 4 2->8         started        12 wscript.exe 1 2->12         started        signatures3 process4 file5 26 C:\Users\user\AppData\Local\...\ageless.exe, PE32 8->26 dropped 62 Binary is likely a compiled AutoIt script file 8->62 14 ageless.exe 2 8->14         started        64 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->64 18 ageless.exe 1 12->18         started        signatures6 process7 file8 28 C:\Users\user\AppData\Roaming\...\ageless.vbs, data 14->28 dropped 66 Multi AV Scanner detection for dropped file 14->66 68 Binary is likely a compiled AutoIt script file 14->68 70 Drops VBS files to the startup folder 14->70 76 2 other signatures 14->76 20 RegSvcs.exe 15 2 14->20         started        72 Writes to foreign memory regions 18->72 74 Maps a DLL or memory area into another process 18->74 24 RegSvcs.exe 2 18->24         started        signatures9 process10 dnsIp11 36 ip-api.com 208.95.112.1, 49713, 49722, 80 TUT-ASUS United States 20->36 38 us2.smtp.mailhostbox.com 208.91.199.223, 49714, 49724, 587 PUBLIC-DOMAIN-REGISTRYUS United States 20->38 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->48 50 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->50 52 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->52 60 2 other signatures 20->60 54 Tries to steal Mail credentials (via file / registry access) 24->54 56 Tries to harvest and steal ftp login credentials 24->56 58 Tries to harvest and steal browser information (history, passwords, etc) 24->58 signatures12
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-04-28 05:52:59 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=piggq27v2phgopbrw5shoxyobtw5fz4ajmu7kfc4beshtsukl7ja._file
Verdict:
malicious
Label(s):
autoit
Create hunting rule
unc_loader_036
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
382b40ce3e7d7fc44a80d1b9190914a401c968be78c7115a8e4e3ccd40b8888d
AgentTesla
474651d4f8f510094648423d6a0d97b51d2847db856251740877331e101dd372
AgentTesla
8310d68a7f689fa70a20da444f64e6694c5513be2839a2fc88aac159d064a38a
AgentTesla
ae729256a89999262e56c6192422dfe736f23f94136a1803b9a5a7778bed51c9
AgentTesla
ca8b529cb0b693f6ff0dfe104fd063c4c161c572980dacd2d6d714a84dcfb03e
AgentTesla
f482d607663a330b6a2393c8c9850bba8eddc53a4f80012c17dfcc416df05880
AgentTesla
+ 1'651 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/250428-llkqyatly2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
UPX packed file
Looks up external IP address via web service
Drops startup file
Executes dropped EXE
AgentTesla
Agenttesla family
Verdict:
Suspicious
Tags:
external_ip_lookup
YARA:
n/a
Link:
https://app.threat.zone/submission/12f237bc-8cf0-4c02-8e5f-a7c1a9595f71
Unpacked files
SH256 hash:
7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2
MD5 hash:
e3fdf3857135e0f078bec72efcebfdf9
SHA1 hash:
627f8bddcf0920192be0e9127d88da08a281e7d5
Link:
https://www.unpac.me/results/c9217300-7d67-44a6-8237-2d6783a4ddd8/
SH256 hash:
92381068ba0659eb245a1ee75d35ade385d9d1c866258482fec1ecf833b0bc38
MD5 hash:
a56552a23b0e99456abff9764ab0a3cd
SHA1 hash:
b1a91454c99cbf6201bd55e09cb946da60e67402
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/c9217300-7d67-44a6-8237-2d6783a4ddd8/
Parent samples :
d28358e40350fd9a8b4433a33131b7f567d66c1f9a20b6bd276178b585304580
2a42400af1f416ee97e512e419076b7769e4dca5a9f2f8cdca717391fa43b9ed
fc523562bc368e6ab9c0106a1f3d6e23c4104f120c65c65b9c9adb2ee57c63ca
72be9fedc41813b76d9a0707925542a7919f9192ca9cdc8ef82b952dce22da4f
1ebc38bc1bd49c8564e94d2242c4deed0bd0d69c0086ab7cc2dc180c77a989ce
b259302d7ea5bfb1f2ad8f50e8de4df48d96021070ee77c5b7819583ec43f372
aeeefebd58a16e9b1c8863728c208e878cdc6095026c6f99e058ebe79c1faa8c
e3490b8097e4e9336d360f9998cc904fc90af46470232c631f3071425bb869e5
9d57211cd89f172b2a56a41e2906df2baff93edf0bf17763769150483b720fe7
bda5884e1a65b59d74d3366608a4841111d43d0b6a865879736f5179bac1bcf3
f2414faf44fac2135ccce1d5fe5c3a53ec3fcde7ad295e2e112af373b02da086
b9ee87f239e3ee4599d666b1b755f97ab4c2ab45507654ec1485f9d60af710ca
7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2
SH256 hash:
55f9581c91c9eef0fe17d5fd4adab77533d0748ff1cc43e2ae593b41d52a1ed3
MD5 hash:
6d6dc3aa6f86a07e94995ee36a450613
SHA1 hash:
bfc96f09b43055a976effb14a0f0f4834aafc47f
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/c9217300-7d67-44a6-8237-2d6783a4ddd8/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7a0c686bf5d3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 7a0c686bf5d3ce673c31b764775f0e0cedd2e7804b29f5145c092479ca8a5fd2

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/4704/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeGetTime
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetUseConnectionW

Comments