MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4c3d84ec9cc462b34a7b7323ef5afa6771fcd19dafbb2c7ac67fdee2cb7cf79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	c4c3d84ec9cc462b34a7b7323ef5afa6771fcd19dafbb2c7ac67fdee2cb7cf79
SHA3-384 hash:	7595662a5954b3e906b6e13694d8e9baff776640856622250e54b498e0e2f7158b0af3c1660def0536278aab8a504029
SHA1 hash:	1b8e14e09d09e9a56022dea44aab0168983c0349
MD5 hash:	411eed68f7898b3c09c36f5a0676c42b
humanhash:	wolfram-steak-uranus-william
File name:	PO# 45821 & 45822.zip
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	2'318 bytes
First seen:	2025-10-06 07:40:14 UTC
Last seen:	2025-10-06 07:47:38 UTC
File type:	zip
MIME type:	application/zip
ssdeep	48:95WA7fbUNjozT9L4TncebKernKdNo7aQ2qfLFr:mA7gezTd4zdbKernWoGLqfLp
TLSH	T1F9414D47024FCBAECF9D50BD3E4316ADF25539025AB69013E5B55CCC818F79242206D3
Magika	zip
Reporter	cocaman
Tags:	AgentTesla zip

cocaman

Malicious email (T1566.001)
From: "Abdullah BABUR <fsur@zooked.win>" (likely spoofed)
Received: "from node.ansuhost.com (unknown [204.10.163.235]) "
Date: "3 Oct 2025 03:33:16 -0700"
Subject: "=?UTF-8?B?UmVxdWVzdCBmb3IgUHJvZm9ybWEgSW52b2ljZSDigJMgUE8jIDQ1ODIxICYgNDU4MjI=?="
Attachment: "PO# 45821 & 45822.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO# 45821 & 45822.js
File size:	4'917 bytes
SHA256 hash:	657269d4918dae28fc64984fb579be1dcb36e304767ec1f66804971c4fcd4b72
MD5 hash:	5a8c8ce8ec6dd4e40c2ff349d4d68d56
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Zip_JsNum.v2.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e372836bc7e25d18cc39f8

Tags:

dropper extens spawn

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/c4c3d84ec9cc462b34a7b7323ef5afa6771fcd19dafbb2c7ac67fdee2cb7cf79/results/dashboard

Payload URLs

URL

File name

http://196.251.85.84/2/STEIN.zip','CopyHere','GET','KzICP','6264995UqyApT','split','Open','1AnRERI','Ktkye','Delete','aaEJb','length','Run','TnlKr','Scripting.FileSystemObject','XFgCg','Sleep','ddJuM','pohVF','rdNiX','hoLCY','ymumx','CreateObject','2268Fvufgf','798816IPUoix','atEnd','charAt','Files','Shell.Application','responseBody','gHWXy','NameSpace','3714320LAZAml','exe','492bduPMj','17645628mcOKBk','xiITJ','Close','CbUOo','gRxnc','kZqkW','bELhL','lbeou','send','xurti','7

JS File

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 evasive nemucod obfuscated opendir opendir

Link:

https://www.filescan.io/uploads/68e3726ec74bd2958b15ddd4/reports/c42d3dbf-2ea9-43ef-8247-8ad57d58d18d/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c4c3d84ec9cc462b34a7b7323ef5afa6771fcd19dafbb2c7ac67fdee2cb7cf79

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/c4c3d84ec9cc462b34a7b7323ef5afa6771fcd19dafbb2c7ac67fdee2cb7cf79

Details

IPv4 Dotted Quad URL

A URL was detected referencing a direct IP address, as opposed to a domain name.

Verdict:

Malicious

File Type:

zip

First seen:

2025-10-03T07:30:00Z UTC

Last seen:

2025-10-07T12:16:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/c4c3d84ec9cc462b34a7b7323ef5afa6771fcd19dafbb2c7ac67fdee2cb7cf79/results?tab=lookup

Score:

98%

Verdict:

Malware

File Type:

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery execution keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/251006-k62draxyfx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Badlisted process makes network request

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c4c3d84ec9cc462b34a7b7323ef5afa6771fcd19dafbb2c7ac67fdee2cb7cf79

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication