MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7d99ebd59c19e0ad5526bd655f0a9f87c32acc0fd0301e2c493002eaadb788ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 14
| SHA256 hash: | 7d99ebd59c19e0ad5526bd655f0a9f87c32acc0fd0301e2c493002eaadb788ca |
|---|---|
| SHA3-384 hash: | aa951c6b4b6f0bd322599d9cf59008a0909309dfffd45105d7c0eb7a833ebecd5890487abc919cd4f8920002039c255e |
| SHA1 hash: | d68dea6143283178bf7bc1d81c65f436b199d1bf |
| MD5 hash: | 368c0895db45c0f08047ddcd65251300 |
| humanhash: | batman-undress-wisconsin-sixteen |
| File name: | KOHINOOR_CHEMICAL_CO_PVT_LTD.cmd.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 832'000 bytes |
| First seen: | 2026-10-14 15:41:24 UTC |
| Last seen: | 2026-10-14 16:10:03 UTC |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'695 x Formbook, 12'401 x SnakeKeylogger) |
| ssdeep | 12288:zUT877N7ViG6LGpKRxDsjw+kHVXzkSTNIwRdj0tV:zUTKXp6LVR0wbHVXvTNIG2 |
| TLSH | T176050214227DDB13D9A24BF12851E13013B91CFE29A1D716BED66CDF3A21F411B12EAB |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | f0e4e2d1c4b8ccf0 (7 x Formbook, 3 x DarkCloud, 1 x AgentTesla) |
| Reporter |  TomU |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
9
# of downloads :
95
Origin country :
CHVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
n/a
ID:
1
File name:
RE_ ARRIVAL NOTICE - KOHINOOR CHEMICAL CO PVT LTD - 15754770181 K215352 _ 0333 3250791.eml
Verdict:
No threats detected
Analysis date:
2026-10-13 19:40:26 UTC
Tags:
susp-attachments attachments attc-arch attc-html arch-exec
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Verdict:
Malicious
Score:
99.1%
Tags:
shell virus lien sage
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a service
Creating synchronization primitives
Changing a file
Blocking the Windows Defender launch
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
agenttesla entropy krypt masquerade obfuscated packed vbnet
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-12T01:57:00Z UTC
Last seen:
2026-10-16T12:39:00Z UTC
Hits:
~1000
Verdict:
Unknown
Score:
99%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.33 Win 32 Exe x86
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Status:
Malicious
First seen:
2026-10-12 04:49:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
29 of 36 (80.56%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection discovery evasion execution keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Modifies Windows Defender DisableAntiSpyware settings
Unpacked files
SH256 hash:
7d99ebd59c19e0ad5526bd655f0a9f87c32acc0fd0301e2c493002eaadb788ca
MD5 hash:
368c0895db45c0f08047ddcd65251300
SHA1 hash:
d68dea6143283178bf7bc1d81c65f436b199d1bf
SH256 hash:
35ad5e5fd945ac5176792169054f55160579446836f49034f64001925bace946
MD5 hash:
34cf0eac1d6e0fe9c3e91a51086b57ea
SHA1 hash:
0af7a7826597a79aa8d9db90c96e230cd94f47df
Detections:
triage_agenttesla_infostealer
win_agent_tesla_g2
Agenttesla_type2
INDICATOR_EXE_Packed_GEN01
INDICATOR_SUSPICIOUS_Binary_References_Browsers
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
MALWARE_Win_AgentTeslaV2
SH256 hash:
7027a66ad02beae0b44dbee8b309086cfd6d06b15fc76673dcb0972d50148ede
MD5 hash:
3cace1725f736e8f6bda0742331213aa
SHA1 hash:
f2e10564378a5648bee9fe746d1896ef090ce5e6
SH256 hash:
031f5387e15cb20e2b022482531e9b863da1c0825c3e057a5197cf1fc75ff5c3
MD5 hash:
e962af4749fabdcda10df6da328f28ad
SHA1 hash:
f335dbd80b7dd1798cde7b4a433167c454d4c7dc
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DotNet_RGB_Embedded_AssemblyLoader_Hunt |
|---|---|
| Author: | ShadowOpCode |
| Description: | Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading |
| Rule name: | HUNT_NET_Loader_ImagePixel_To_AssemblyLoad |
|---|---|
| Author: | Anish Bogati |
| Description: | Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders. |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Runtime_Broker_Variant_1 |
|---|---|
| Author: | Sn0wFr0$t |
| Description: | Detecting malicious Runtime Broker |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait |
|---|---|
| Author: | Marjoriefort |
| Description: | Detects Derialock (pe, etat extrait) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.