MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d29dcb43bbd193886e29b48107ac1d8664f24a9ad4dd5d2a07c8fa460975dcc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 10

Intelligence 10 IOCs YARA 11 File information Comments

SHA256 hash:	d29dcb43bbd193886e29b48107ac1d8664f24a9ad4dd5d2a07c8fa460975dcc2
SHA3-384 hash:	5d7841776b1fab808e2f18bbd2f344a2e2e50629bb696e2b1c62d6e878683634f4af5cbeec8f435f455a1f7ebfd8fdfc
SHA1 hash:	f2b9f3e08aa8afda8172701073b762a2941e988d
MD5 hash:	7c588980fad5b033a2da3da80ec9a02c
humanhash:	queen-fanta-east-bakerloo
File name:	689504271.7z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	700'090 bytes
First seen:	2025-12-09 09:28:32 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	12288:2XRFhQ2r+aMlaV3ZRAKHoy77PI0+NQHZUgOP+0wC7dLJzoxYq:IRxlDJuGbVSQ5Ug50wC7non
TLSH	T162E4336CEAEE3DEE06E791C22602875B8936454F74122CA534F43EE278BDC79B71560C
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	cocaman
Tags:	7z AgentTesla

cocaman

Malicious email (T1566.001)
From: "export@laokaiyuan.com" (likely spoofed)
Received: "from mail.laokaiyuan.com (mail.laokaiyuan.com [192.227.129.137]) "
Date: "9 Dec 2025 03:46:09 +0100"
Subject: "PRE ALERT FINAL DOCS HBL & MBL"
Attachment: "689504271.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	689504271.exe
File size:	1'243'136 bytes
SHA256 hash:	23639854fe3670be010755514ab0cbe420ae48da8b13f8043f6ba176c6d62202
MD5 hash:	cd180586205708705712cc9b3510c442
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

No detections

Detection(s):

Win.Dropper.Zeus-9996119-0

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6937dd2cdb58e1a2c22ba840

Tags:

autoit emotet lien

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/d29dcb43bbd193886e29b48107ac1d8664f24a9ad4dd5d2a07c8fa460975dcc2/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint keylogger microsoft_visual_cc packed zeus

Link:

https://www.filescan.io/uploads/6937ebebff25e40750d90a14/reports/d6434ca8-2b80-45d7-bc33-9029cc3b8eba/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d29dcb43bbd193886e29b48107ac1d8664f24a9ad4dd5d2a07c8fa460975dcc2

Verdict:

Malicious

File Type:

First seen:

2025-12-08T22:49:00Z UTC

Last seen:

2025-12-10T11:30:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/d29dcb43bbd193886e29b48107ac1d8664f24a9ad4dd5d2a07c8fa460975dcc2/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/251209-n3lexawmfz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

AgentTesla

Agenttesla family

Malware Config

C2 Extraction:

https://api.telegram.org/bot8194658562:AAEAkHGba5YUASDs5JFXv6GHA22t6IXyf9I/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d29dcb43bbd193886e29b48107ac1d8664f24a9ad4dd5d2a07c8fa460975dcc2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator