MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f
SHA3-384 hash: ec152c37f0954a917d1a38e941fd781d974b1725868d2f73a628e9127a0e9b16657e469c6ced50b351835970f8733c13
SHA1 hash: c27f6226a7945831530b3c484121987fa11aa21e
MD5 hash: ed2373b88d11beebdd5553601e25985b
humanhash: fish-oscar-venus-mountain
File name:purchase_order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:616'960 bytes
First seen:2026-05-20 17:06:49 UTC
Last seen:2026-05-20 18:08:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'131 x AgentTesla, 20'159 x Formbook, 12'362 x SnakeKeylogger)
ssdeep 12288:/dnT5jt/Js/Fxu9WALjgj8TTAFFeucjptzxg7HEfvQNkj1onosojAQNIXRe/:/9RR2HjAHgj8TeFeucNcAfnjgSAgU
TLSH T1AED41248669ECA02DAA71B701C71E5B13B287FA9DD30C54F9FDA2EEFB47A6245001353
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter TomU
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/05eae032-09dc-4b6f-9867-c8a8b1a68fe7/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-05-20 20:22:54 UTC
Tags:
stealer ultravnc rmm-tool exfiltration smtp amsi-bypass agenttesla
Link:
https://app.any.run/tasks/83a86462-df59-4b67-8e8b-70acffa683e7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/66772/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.3223.7229.4313.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0dece74159ce11f601cc3f
Tags:
stration shell virus lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Sending a custom TCP request
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a service
Changing a file
Stealing user critical data
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt masquerade packed vbnet
Link:
https://www.filescan.io/uploads/6a0dedb4875badc3b38eae54/reports/fc9b2fd1-93cf-4226-b124-2f81164f0536/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-02T04:18:00Z UTC
Last seen:
2026-05-08T12:07:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/11f0f523-de1c-45c3-b386-0aa6c28dbb0d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-12-02 07:12:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
29 of 37 (78.38%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wytfnjnp4zgsckxyrgi37iybp5lgqzwlmxxbr25wbu7sddijvipq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
wannacryptor
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/260520-vncmsahw5x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f
MD5 hash:
ed2373b88d11beebdd5553601e25985b
SHA1 hash:
c27f6226a7945831530b3c484121987fa11aa21e
Link:
https://www.unpac.me/results/631b4f6b-e874-495d-8c75-dd95ef6e505b/
SH256 hash:
32b1b99bb30329b8abe9e58978e17b744ab9d872bf8b2816a6b936f3f778c044
MD5 hash:
2754c4b329103cff28a24ddd36d7be2d
SHA1 hash:
2cb48ec9ad7ccadb0024df09b2688f5d6cc13bc4
Link:
https://www.unpac.me/results/631b4f6b-e874-495d-8c75-dd95ef6e505b/
SH256 hash:
4b64d792c21e7859539d933e2f860d8c764e1df915653234ece3d2a456328fbb
MD5 hash:
0e3016b6ea3f822ab8670c6242bac5cf
SHA1 hash:
35eb0f545e8f2737aac1a2f2da4145d96d24993f
Link:
https://www.unpac.me/results/631b4f6b-e874-495d-8c75-dd95ef6e505b/
SH256 hash:
af42501416d90da366e22ee7aa53ca7ba96ef11c7c34e5aae62ec421cc20bfc0
MD5 hash:
b559a754e89c10787515f89498e9165d
SHA1 hash:
e1a0e504abc63689029780f7cb11d82940358eb0
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/631b4f6b-e874-495d-8c75-dd95ef6e505b/
Parent samples :
45f1f0c4c76cee479f0bb2966f4d9c157e344f9749cdfeb5e4b396aa3285c18d
dae47ed76de2cef73a060c73c57311c4e770a072ba9947f8c8f64b83455cd839
38713a538ea46799f3de660b3ff86d5888c71fab824b330c986ab03ff0a07382
c237d2897a77f44f53d5a1e5b033ca2b7757601b9352b904c80a7415d85cf7fe
87c9b23d3ac3e48910f9d204708f95d337fab4161b5fc8a9a32735cfe7b8d83d
bd5956f9fd66c84b123aa6973dd568adf93c4015ad1716c345cbaab5843a6e31
eee3109f9c51979defaefbcac875ac871f74995af6750909b8bd6958add3cbf8
bd17bb7ef1b86d6ee46268eb2779c9e7c2058deb907df45280ddc0ec6ecea41e
ba514304ee5435dcd4cac761a79f9b22e5c47f8b6070b75a3cdf5af42a484314
72e8a41076d479069a5f01db9b06b83dffbde52d62e185fb86ab6c4b67fc9270
b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b62656a5afe6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b62656a5afe64d212af88991bfa3017f566866cb65ee18ebb60d3f218d09aa1f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/66772/

Comments