MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af
SHA3-384 hash: be44ff3ae078d107d9e11ad3bba3610bd555c6b9ab7815dc0bd316ad6c91030d845dc93a2148bf0d171bcbf164eb10cf
SHA1 hash: eac82eb626a540f7cc48489669ded80a3fd0bf72
MD5 hash: 8ac29f6612ce5d5ff013b776e0643b0b
humanhash: august-nevada-five-alanine
File name:Final Invoice_PL, Inv-116, Po-864 90249301_56B7850_56B7852_MX.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:805'376 bytes
First seen:2025-04-23 11:48:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:RluVvbilaay84PILEIx8dH9VWOVYQN1wxMKQVYPOn0FsEQ5V3vNctD5DzRuirm22:aVv2laVwLEIx+VBmQPwbM8kHvytS
Threatray 3'393 similar samples on MalwareBazaar
TLSH T1F30501483748AC0FC09B4EB98D61DE78A6709CA96B07D303ADE73DEF795D6469A003D1
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 88c0e8ba62f49a97 (11 x Formbook, 3 x AgentTesla, 2 x SnakeKeylogger)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
427
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
Final Invoice_PL, Inv-116, Po-864 90249301_56B7850_56B7852_MX.exe
Verdict:
Malicious activity
Analysis date:
2025-04-23 12:18:23 UTC
Tags:
netreactor evasion stealer telegram exfiltration ultravnc rmm-tool agenttesla ims-api generic
Link:
https://app.any.run/tasks/2ae2f12b-88fa-4fa4-8a51-6f3155a73989

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/3667/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.15848.10257.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6808d5c6a37ff28e12988d70
Tags:
agenttesla lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
entropy masquerade obfuscated obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/6808d38c1c0e4b306dfecdeb/reports/e3aab932-03f9-44cc-baad-b487dc2954d3/overview
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ccd93d7-b4ad-4fa1-a166-8608d6e21021
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1671988
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1671988 Sample: Final Invoice_PL, Inv-116, ... Startdate: 23/04/2025 Architecture: WINDOWS Score: 100 53 api.telegram.org 2->53 55 api.ipify.org 2->55 71 Suricata IDS alerts for network traffic 2->71 73 Found malware configuration 2->73 75 Malicious sample detected (through community Yara rule) 2->75 79 15 other signatures 2->79 8 Final Invoice_PL, Inv-116, Po-864 90249301_56B7850_56B7852_MX.exe 7 2->8         started        12 CjaZgZnBSSJxW.exe 5 2->12         started        14 svchost.exe 2->14         started        signatures3 77 Uses the Telegram API (likely for C&C communication) 53->77 process4 dnsIp5 41 C:\Users\user\AppData\...\CjaZgZnBSSJxW.exe, PE32 8->41 dropped 43 C:\...\CjaZgZnBSSJxW.exe:Zone.Identifier, ASCII 8->43 dropped 45 C:\Users\user\AppData\Local\...\tmp143C.tmp, XML 8->45 dropped 47 Final Invoice_PL, ..._56B7852_MX.exe.log, ASCII 8->47 dropped 81 Adds a directory exclusion to Windows Defender 8->81 83 Injects a PE file into a foreign processes 8->83 17 Final Invoice_PL, Inv-116, Po-864 90249301_56B7850_56B7852_MX.exe 15 2 8->17         started        21 powershell.exe 23 8->21         started        23 schtasks.exe 1 8->23         started        85 Multi AV Scanner detection for dropped file 12->85 87 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->87 89 Contains functionality to register a low level keyboard hook 12->89 25 CjaZgZnBSSJxW.exe 12->25         started        27 schtasks.exe 12->27         started        29 CjaZgZnBSSJxW.exe 12->29         started        31 SgrmBroker.exe 12->31         started        57 127.0.0.1 unknown unknown 14->57 file6 signatures7 process8 dnsIp9 49 api.telegram.org 149.154.167.220, 443, 49682, 49684 TELEGRAMRU United Kingdom 17->49 51 api.ipify.org 104.26.13.205, 443, 49681, 49683 CLOUDFLARENETUS United States 17->51 59 Installs a global keyboard hook 17->59 61 Loading BitLocker PowerShell Module 21->61 33 WmiPrvSE.exe 21->33         started        35 conhost.exe 21->35         started        37 conhost.exe 23->37         started        63 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->63 65 Tries to steal Mail credentials (via file / registry access) 25->65 67 Tries to harvest and steal ftp login credentials 25->67 69 Tries to harvest and steal browser information (history, passwords, etc) 25->69 39 conhost.exe 27->39         started        signatures10 process11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af/
Threat name:
Win32.Trojan.Jalapeno
Create hunting rule
Status:
Malicious
First seen:
2025-04-14 23:25:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5zrbdgub3nrdf3iz7rw5rmzjxvafotzreo5kefkm6537gjzsq6xq._file
Verdict:
malicious
Label(s):
captiveaaloader
Create hunting rule
unc_loader_037
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
357b3313f39b40d4b9acc1181d3eca642418b945e0b35cc0f3c436b9598fd8a5
AgentTesla
dbbf0fd1d25e6411faddab4b2f689dcffd04ce06642e1319f9d6fb00a2c343ca
AgentTesla
e1c7a0142096027135342d53d50e982ca0db4683cb578fa7528f7da6394397d6
AgentTesla
ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af
AgentTesla
error
AgentTesla
fc523562bc368e6ab9c0106a1f3d6e23c4104f120c65c65b9c9adb2ee57c63ca
AgentTesla
+ 3'383 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/250423-nymr6swzdy/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
AgentTesla
Agenttesla family
Malware Config
C2 Extraction:
https://api.telegram.org/bot7309095694:AAEXFDt7C83fFTVGyimcrdZyYXx9OkR4Q6g/
Verdict:
Malicious
Tags:
external_ip_lookup
YARA:
n/a
Link:
https://app.threat.zone/submission/75d17eb5-5e00-4cd8-9a33-00172172a410
Unpacked files
SH256 hash:
ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af
MD5 hash:
8ac29f6612ce5d5ff013b776e0643b0b
SHA1 hash:
eac82eb626a540f7cc48489669ded80a3fd0bf72
Link:
https://www.unpac.me/results/2365203a-fe48-4011-b542-99c321e81658/
SH256 hash:
2af5e1b7f4bf6f072491725b87c2b91067cfff5b89d88c36ab94f24d94fb50bf
MD5 hash:
8389ed4a149183286afb95ddc8211eff
SHA1 hash:
13a8a4fa4c55ea50c612fa51ac2ec6e99bbc70cc
Detections:
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/2365203a-fe48-4011-b542-99c321e81658/
Parent samples :
ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af
4c92515686989d9fda1f9107b0afc093b96a4ca563b751079b4bb8903068c731
54a62632695cf41c6a7ea5a34386d8511bf6ef7ddcb865ba716542f8b059e622
912421c5e67b1f2f502b615413c02a9e7c9d92d121baa694438ab3608b4b9f88
fca8a83c6fc8c413126b1c8466c1d4760fe4f5e354e7ca843c86cbb417cb20f6
49e15a9ace08da2ee62f808c51dbbb91742fe4d3262fcce88e84fdd50d813abd
2f275cb26e70027332fb1a62f86ca222924062b48866f5d9d5936471ce88f0cb
SH256 hash:
8c220de2539681c27157eb029de7ca87b3a978fb2ff9069e1be3f1e7dc8da4fb
MD5 hash:
4376250eea0838e54a7b2a8ec7673781
SHA1 hash:
1ff24812c98573ec13df9fffee0f1bc2ee5607d7
Link:
https://www.unpac.me/results/2365203a-fe48-4011-b542-99c321e81658/
SH256 hash:
00e8ee5442ccde5333d0186fa96b387c16f3f0c9b391d5645094cb7e38de1097
MD5 hash:
fe18dd5637a3ddd1b886e310af8188ca
SHA1 hash:
9faf6341280f188317437dcf0862074812422afa
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/2365203a-fe48-4011-b542-99c321e81658/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe ee62119a81db6232ed19fc6dd8b329bd40574f3123baa2154cf777f3273287af

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/3667/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments