MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90
SHA3-384 hash: 4489cf5fb750d9b93723be31de61abb5fb3635771ed94ca6775062525e825c9e1537b198e1f285cb633f7cfbbcfce8ea
SHA1 hash: 619a2821af487c977a37491c8a4411f9cd54caf2
MD5 hash: 742b30c737aaeb6f953f9e77307eb626
humanhash: connecticut-montana-arkansas-uniform
File name:Proforma invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:670'432 bytes
First seen:2025-12-10 07:59:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3abe302b6d9a1256e6a915429af4ffd2 (277 x GuLoader, 38 x Formbook, 25 x Loki)
ssdeep 12288:CGhUY/UEKoiJAHFt8smjVfZMcHBXLOYGJNvipWoRm2W6ag2w1AqXEYfff:CGriJ0DmTM68dJhipHtW6amAk
TLSH T160E4232536D1D237ED8646322C878AF986E89DC565151A4FFBE03E24FD326231B042EF
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Anonymous
Tags:AgentTesla exe signed

Code Signing Certificate

Organisation:Rumfangsberegning
Issuer:Rumfangsberegning
Algorithm:sha256WithRSAEncryption
Valid from:2025-12-02T11:07:25Z
Valid to:2026-12-02T11:07:25Z
Serial number: 5220aa85b0ac24d894bbe69fe9e73e0b486a75b9
Thumbprint Algorithm:SHA256
Thumbprint: 3bd26017fefe6cd4b957a6248063437e3eebfd198d8a9f08520154b8e7db0024
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
PL PL
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5cb1e872-7c21-4463-9622-bcf9de6e3655/
Malware family:
guloader
Create hunting rule
ID:
1
File name:
_83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90.exe
Verdict:
Malicious activity
Analysis date:
2025-12-10 08:04:48 UTC
Tags:
guloader
Link:
https://app.any.run/tasks/f3ee0899-ca45-4bd3-872c-5cb6dc3dac0e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/44122/
Detection(s):
SecuriteInfo.com.Adware.Downware.19579.26308.2454.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6939289ebde6a3e5970fb6ae
Tags:
injection obfusc virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a file in the %temp% subdirectories
Searching for the window
Searching for the Windows task manager window
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer installer installer-heuristic masquerade microsoft_visual_cc nsis overlay signed
Link:
https://www.filescan.io/uploads/6939289964bd958a520f764b/reports/2c04fd49-6ae2-4cdf-8b59-ba15906b0689/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-09T06:02:00Z UTC
Last seen:
2025-12-12T06:20:00Z UTC
Hits:
~10000
Detections:
Trojan.Makoob.HTTP.C&C Trojan-Downloader.Win32.Minix.sb Trojan-PSW.Agensla.TCP.C&C HEUR:Trojan.Win32.Makoob.gen HEUR:Backdoor.Win32.Androm.gen Backdoor.Androm.HTTP.Download Trojan-Downloader.Win32.GuLoader.sb Trojan.Win32.Inject.sb Trojan.NSIS.Makoob.sba
Link:
https://opentip.kaspersky.com/83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90/results?tab=lookup
Malware family:
NSIS
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/74957346-8143-4a9f-9a92-9d1e8f4ca6ae
Score:
83%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/742b30c737aaeb6f953f9e77307eb626
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-09 08:49:51 UTC
File Type:
PE (Exe)
Extracted files:
35
AV detection:
17 of 38 (44.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qmayzohs5z7pqcq5dljhiwpjrgmoklk64felqfwqyosexxfl7sia._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:guloader discovery downloader execution installer keylogger persistence ransomware spyware stealer trojan
Link:
https://tria.ge/reports/251210-jv8g9awnak/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Badlisted process makes network request
Looks up external IP address via web service
Loads dropped DLL
AgentTesla
Agenttesla family
Guloader family
Guloader,Cloudeye
Verdict:
Malicious
Tags:
loader guloader
YARA:
NSIS_GuLoader_July_2024
Link:
https://app.threat.zone/submission/048c9345-da01-48cd-bc70-35314a0a7b48
Unpacked files
SH256 hash:
83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90
MD5 hash:
742b30c737aaeb6f953f9e77307eb626
SHA1 hash:
619a2821af487c977a37491c8a4411f9cd54caf2
Link:
https://www.unpac.me/results/57a924a1-ba63-4124-8ff3-c16d8c3a41a2/
SH256 hash:
7f8f11563fd1b681625b8ce19cbcaa0464139a0541f7059f8841b6a43cb2dbab
MD5 hash:
6a6b3466fcbc0878af7f1b092b358a73
SHA1 hash:
0e9675968ed6c32c599ef79068ad941c2dd0ab76
Link:
https://www.unpac.me/results/57a924a1-ba63-4124-8ff3-c16d8c3a41a2/
SH256 hash:
4bf14031eb0460e4e8234ef1157d8a254354504ced37f86fdbb1644ed45302c0
MD5 hash:
a4e21a6c9cde2319a1d2dc7335229e47
SHA1 hash:
141082e43fd1bbe6e5ac022dd4074b6c9e7a23d4
Detections:
win_flawedammyy_auto
Create hunting rule
Link:
https://www.unpac.me/results/57a924a1-ba63-4124-8ff3-c16d8c3a41a2/
Parent samples :
44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e
b3a1509f77da1f09f79e2d0d6b6c6938db01f8ec67fa6adcf992eeb5b6b8698a
6a3648d9ef381db17f71b6e13ed8006fd12069183e2824b455a170afc64fa0ba
7b7c066f031d5021b3ce30236a545cfea9736fded345e10d3380dd5c89447417
145c299180fb1556c843a944b33f57c933382c801906a9b7ce3f59f7028b0409
83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90
SH256 hash:
e7b145abc7c519e6bd91dc06b7b83d1e73735ac1ac37d30a7889840a6eed38fc
MD5 hash:
50ba20cad29399e2db9fa75a1324bd1d
SHA1 hash:
3850634bb15a112623222972ef554c8d1eca16f4
Detections:
win_flawedammyy_auto
Create hunting rule
Link:
https://www.unpac.me/results/57a924a1-ba63-4124-8ff3-c16d8c3a41a2/
Parent samples :
44dc55275444f583d81f224be2172d1468ca7901032329ad2210a3b7abfaf80e
b3a1509f77da1f09f79e2d0d6b6c6938db01f8ec67fa6adcf992eeb5b6b8698a
6a3648d9ef381db17f71b6e13ed8006fd12069183e2824b455a170afc64fa0ba
7b7c066f031d5021b3ce30236a545cfea9736fded345e10d3380dd5c89447417
145c299180fb1556c843a944b33f57c933382c801906a9b7ce3f59f7028b0409
83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/83018cb8f2ee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/44122/

Comments