MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d250ffab65b17e6495878e5feac43dc7610f5c49c0a7739170ed17a011d22c26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d250ffab65b17e6495878e5feac43dc7610f5c49c0a7739170ed17a011d22c26
SHA3-384 hash: 69b049eb18b52bbf9f56e1ed9de2a851898e37c19450a32c39bef3f484742199ae65db810a30ee14fb5ebc948855be57
SHA1 hash: 8545b751676f069eae509b90772cba908a4ac260
MD5 hash: 1d10dbd561e2ec6a6133871ca5172662
humanhash: blue-blossom-zebra-twenty
File name:NEW BOOKING PDF 03.vbs
Download: download sample
Signature AgentTesla
Create hunting rule
File size:15'698 bytes
First seen:2025-11-24 09:06:02 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:XPzZjhfOZxy2LFvTuZGa43aDPa6nvlPcPZvmIqdHm+wcyh:X7ZVCpvSZf3ERv/qdHSB
Threatray 3'831 similar samples on MalwareBazaar
TLSH T17862243B955CEFF00B3E21F4118B7D1120619326A93A8D6D9CD68198BF2B7518F678EC
Magika vba
Reporter JAMESWT_WT
Tags:AgentTesla booking Spam-ITA vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41218/
Detection(s):
TwinWave.EvilVBA.LostAtSeaFuncInDirection.20240306.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692420087d4abc02d4bcabbe
Tags:
n/a
Verdict:
Malicious
Labled as:
Trojan.Script.Downloader
Link:
https://www.hybrid-analysis.com/sample/d250ffab65b17e6495878e5feac43dc7610f5c49c0a7739170ed17a011d22c26
Verdict:
Malicious
File Type:
vbs
First seen:
2025-11-23T20:11:00Z UTC
Last seen:
2025-11-26T07:26:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Trojan-Downloader.PowerShell.NanoShield.sb Trojan.JS.SAgent.sb HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic HEUR:Trojan.Multi.Stego.gen Trojan.VBS.SAgent.sb Trojan.MSIL.Crypt.sb
Link:
https://opentip.kaspersky.com/d250ffab65b17e6495878e5feac43dc7610f5c49c0a7739170ed17a011d22c26/results?tab=lookup
Score:
93%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d250ffab65b17e6495878e5feac43dc7610f5c49c0a7739170ed17a011d22c26
Verdict:
Malware
YARA:
1 match(es)
Tags:
VBScript WScript.Network
Link:
https://app.malva.re/file/1d10dbd561e2ec6a6133871ca5172662
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d250ffab65b17e6495878e5feac43dc7610f5c49c0a7739170ed17a011d22c26/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/d250ffab65b17e6495878e5feac43dc7610f5c49c0a7739170ed17a011d22c26
Threat name:
Script-WScript.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-11-24 02:22:37 UTC
File Type:
Text (VBS)
AV detection:
13 of 37 (35.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2jip7k3fwf7gjfmhrzp6vrb5y5qq6xcjyctxhelq5ul2aeosfqta._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
03a4caccc4cfc4dc5e3b37cdcd2f9bf61779a8ab79c38be7269d88bbdea1b212
AgentTesla
1f0c9c08260580d32bf3f2ba499d5812b93d792a99b6f0b6d4767510219cda3b
AgentTesla
305e8cf66668a19599e9e03a5f32d00a524fb45a4385c28978d3713de9cca6c3
AgentTesla
578ba6b07127e3551fe4f48d84b0a901c6ccc063bd88988c05ab3f7fc55761de
AgentTesla
6385ba95a2f179fac688bc5524caebdd20de2fdd3ddbbc531351f8db1965660c
AgentTesla
68c553786094522830920122539df1d3a8f04caf880d84415728ffac780a4c84
AgentTesla
7f0f163959167b201b99ebe9695944e5b9c3ac7536fc84023aac565b0c21d3d4
AgentTesla
ada3af84801eb7e4a28b6e1371b963e820fafc35bd6b7bd15a9a08180cbc17c5
AgentTesla
c299d556c97d0efb665ebdcd3f47593b689c3a997c019c27914402361b3d28ba
AgentTesla
ca0a9efe77e9b198d4f40f91aa9cdd9d9ff085f7e1f5ed0453917108917d8819
AgentTesla
error
AgentTesla
+ 3'821 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla defense_evasion discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/251124-k2wmps1mgs/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
AgentTesla
Agenttesla family
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d250ffab65b1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d250ffab65b17e6495878e5feac43dc7610f5c49c0a7739170ed17a011d22c26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/41218/

Comments