MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 25 File information Comments

SHA256 hash:	cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1
SHA3-384 hash:	1f2acbdc413de92b3baea8575aea1db927b7e31828972d83766a91f84655c965ba4b7bd790795a8949eb5508d4c1ea06
SHA1 hash:	60b68038b1b32cca475c74b9aed38c029bbe0db9
MD5 hash:	57cf7cc3859daf9dd7db35593a8709f8
humanhash:	montana-red-nineteen-michigan
File name:	Quotation.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'066'496 bytes
First seen:	2026-05-20 16:51:40 UTC
Last seen:	2026-06-08 09:13:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'291 x AgentTesla, 20'706 x Formbook, 12'401 x SnakeKeylogger)
ssdeep	24576:0Snfgyt/ik2XSW/W4iSqsZTOCMiqoGTKXx73Fxo9yDR:0Sn4yt/dSSW/WfSqsZTQiqwNLoAD
TLSH	T1963512492799CE06D9D24FB855B0E3B4077C4D89EA11C3138FEDBC9FB4A979228543E2
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	TomU
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f84686e5-ed4b-4c4f-9d06-c0ce4cb04196/

Malware family:

agenttesla

ID:

File name:

Quotation.zip

Verdict:

Malicious activity

Analysis date:

2026-04-30 07:41:46 UTC

Tags:

arch-exec susp-lnk evasion stealer ftp agenttesla exfiltration

Link:

https://app.any.run/tasks/5fd58ecd-0196-4281-847e-2f3db028805a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/66726/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0de4df4f2b29ce0401d8c3

Tags:

autorun lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Launching a service

Changing a file

Stealing user critical data

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

krypt packed vbnet

Link:

https://www.filescan.io/uploads/6a0de96378f38c56ac73ef25/reports/1e66dd42-5dd0-491b-a5a5-669831c46891/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-04-30T03:59:00Z UTC

Last seen:

2026-05-22T00:02:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1/results?tab=lookup

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4e9044fb-aad9-4d4e-a307-847c23047755

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1

Gathering data

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1/

Threat name:

Win32.Trojan.PhantomStealer

Status:

Malicious

First seen:

2026-04-30 13:08:14 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z7tvmv2arqpgsthkuod34izlrramq37mu2u6c6ouqidczk2uxoyq._file

Verdict:

malicious

Label(s):

wannacryptor

agenttesla

Similar samples:

error

AgentTesla

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260520-vdvqlshv6s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Drops startup file

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

Unpacked files

SH256 hash:

cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1

MD5 hash:

57cf7cc3859daf9dd7db35593a8709f8

SHA1 hash:

60b68038b1b32cca475c74b9aed38c029bbe0db9

Link:

https://www.unpac.me/results/aa084eb8-a93b-494c-8f6a-ec60389010e4/

SH256 hash:

8132870454a1a16859a93c7f863186702278859f9d8c83de54816fed2c5911a5

MD5 hash:

25740285bf8aeb8301d9912a3827a108

SHA1 hash:

7f1c708f89145f80c7fe55c34d479356c0479bdb

Detections:

win_agent_tesla_g2

triage_agenttesla_infostealer

Link:

https://www.unpac.me/results/aa084eb8-a93b-494c-8f6a-ec60389010e4/

Parent samples :

d2905e367942c6409ddde8fd54c857d68e34e61927f2c617fa1693713dbd4ca4
ba5667043566050e766cc0559f1a8be0890dea5ee2fb9dc54646cb1e3362148e
8132870454a1a16859a93c7f863186702278859f9d8c83de54816fed2c5911a5
303f75978a35d4835f456943a7f096546881f3e7f1680da167dd64f2c3abbb5f
cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1
1f1cf78513797910c0beffe5a1eb57cefe7748934dfd342fa6b2a3d00270de94
99827faa913d948edcdcca352ee754c696728c70d0b6bdb100a7fd8afee2b8c7

SH256 hash:

a2c5cffceb894c186288d4b0e38cbb01be1aec57bf698aa041c2012d0d0b095d

MD5 hash:

f03fee0b6129842c942bec829dff51c4

SHA1 hash:

930e71721b4575067f5913dad2262e8b42dca38d

Link:

https://www.unpac.me/results/aa084eb8-a93b-494c-8f6a-ec60389010e4/

SH256 hash:

5daf207a021b4e1182494e35b8391b643b4ee2badd4eb7e265dc83cb59780c3b

MD5 hash:

64f5cbcd94dcda49f33b5dcd419e4e7d

SHA1 hash:

cdf3154542a62015b26b1d2a388fa9aa23a5a7f7

Link:

https://www.unpac.me/results/aa084eb8-a93b-494c-8f6a-ec60389010e4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV2 Create hunting rule
Author:	ditekshen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	MALWARE_Win_AgentTeslaV2 Create hunting rule
Author:	ditekSHen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Generic_Threat_779cf969 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe cfe75657408c1e694ceaa387be232b8c40c86feca6a9e179d482062cab54bbb1

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/66726/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample