MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc59432c013a67e42a5b0199f9e205890954a7095b68f1391d9ea931c3a7d65e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cc59432c013a67e42a5b0199f9e205890954a7095b68f1391d9ea931c3a7d65e
SHA3-384 hash:	fc694f7f62125f3ba12764197e894b24a60a9669b7b129471c61c26fa60e0d1b32d1a7ab4bd0de5d5840f350a8fd4f77
SHA1 hash:	544f512d1c7f4bead62d9559f0079b94687053a6
MD5 hash:	5b4bb519e558fa8bc1ae5d632ca5509c
humanhash:	fanta-low-arizona-winter
File name:	Booking_580_322.vbs
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	18'481 bytes
First seen:	2026-02-03 13:04:05 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	384:7dRs4Gs8hlJcAPhrObmsKg/1h9xuBoCHiQJPxj+mHK:7c4FiMTa+jCRdVdK
Threatray	3'629 similar samples on MalwareBazaar
TLSH	T14082663BE55CDFF40B2E21E4508B3D016098A7A5B53A89BDD8D6C158BF267408F978EC
Magika	vba
Reporter	JAMESWT_WT
Tags:	AgentTesla Spam-ITA vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

77

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/51443/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.65213172.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6981f263183032faf3eee97f

Tags:

infosteal

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 obfuscated obfuscated powershell

Link:

https://www.filescan.io/uploads/6981f262b6bd365f0a69e99a/reports/7c816e43-611c-473b-99e7-5e1abec6d1e9/overview

Hybrid Analysis VBS/Agent.TGD trojan

Verdict:

Malicious

Labled as:

VBS/Agent.TGD trojan

Link:

https://www.hybrid-analysis.com/sample/cc59432c013a67e42a5b0199f9e205890954a7095b68f1391d9ea931c3a7d65e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-02-03T08:58:00Z UTC

Last seen:

2026-02-05T05:57:00Z UTC

Hits:

~100

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic UDS:DangerousObject.Multi.Generic Trojan-Downloader.SLoad.TCP.ServerRequest PDM:Trojan.Win32.Generic Trojan-Downloader.PowerShell.NanoShield.sb

Link:

https://opentip.kaspersky.com/cc59432c013a67e42a5b0199f9e205890954a7095b68f1391d9ea931c3a7d65e/results?tab=lookup

Nucleon Malprob Malware

Score:

90%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cc59432c013a67e42a5b0199f9e205890954a7095b68f1391d9ea931c3a7d65e

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/cc59432c013a67e42a5b0199f9e205890954a7095b68f1391d9ea931c3a7d65e

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-03 13:02:47 UTC

File Type:

Text (VBS)

AV detection:

5 of 24 (20.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zrmuglabhjt6iks3agm7tyqfreevjjyjlnupcoi5t2utdq5h2zpa._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

0ddf564c0265cbd758d09ec937b19be19b436a18533995da7d0f9af5d0abfbf3

AgentTesla

31eadb85a13e58678b4b3c4576b7a0ba59b57f9adff72fe8f998313a0f54827a

AgentTesla

939a66d4d9702e973dfbcf9144290a7a4f708626fe10f5e004c54974a6774c77

AgentTesla

98d73d3a7bbc47cdfbd869fe511e9164a1aab7bcf1d4996ba2f99506a82395df

AgentTesla

b3b07e101e7ad560fd4b314b63933f4858954aff535688e255b25909296f847e

AgentTesla

c299d556c97d0efb665ebdcd3f47593b689c3a997c019c27914402361b3d28ba

AgentTesla

d9dcc750e92090e36769db3f0ed8997a0f68c81ebdaef0f7ad5716735fbabf0c

AgentTesla

e6f300bff6975e878e39b0575190ab7b40349f41b8f442906169c8b6a19a7a5e

AgentTesla

error

AgentTesla

+ 3'619 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla defense_evasion discovery execution keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/260203-qa5n7aaw8d/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cc59432c013a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cc59432c013a67e42a5b0199f9e205890954a7095b68f1391d9ea931c3a7d65e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/51443/