MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 21 File information Comments

SHA256 hash:	f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b
SHA3-384 hash:	30b10538b42350bb525a24e0ace6fdddf45494fbddb3b24b71abbd78cf9b3a2bf52922032ece4aa19ef968078857718e
SHA1 hash:	fdaec8fd7d55e1b4b04595e235c0b542b635582b
MD5 hash:	6962ac2f17edee589dddf15214475713
humanhash:	october-fifteen-virginia-oven
File name:	OVERDUE - ACCOUNT LETTER.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	699'904 bytes
First seen:	2025-08-07 09:13:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	12288:me3NBJjOoGMtD6dqWQh53fPoteQSSD5uBsCpXhtdMXIbvXDQ:/NBJyoGMtGUTfQeQSltlP
Threatray	3'450 similar samples on MalwareBazaar
TLSH	T1F3E4127A754CC00BC0D566F584A2F73A43BC1E6FE742E34AEAD5ADDB710B3A02419396
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	d9b8e8e8e96982ce (6 x SnakeKeylogger, 4 x AgentTesla, 4 x Formbook)
Reporter	cocaman
Tags:	AgentTesla DHL exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

OVERDUE - ACCOUNT LETTER.tar.001

Verdict:

Malicious activity

Analysis date:

2025-08-07 09:16:37 UTC

Tags:

arch-exec stealer evasion ultravnc rmm-tool auto-sch-xml agenttesla

Link:

https://app.any.run/tasks/613b38a0-9867-4ed4-bfb8-58695acc2119

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/19442/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68946e491e8a59ee04e6ef5e

Tags:

micro spawn shell

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a process with a hidden window

Creating a file in the %temp% directory

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Sending a custom TCP request

DNS request

Connection attempt

Reading critical registry keys

Launching a service

Forced shutdown of a system process

Stealing user critical data

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated obfuscated obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/68946e88397fd3ce6fa08a43/reports/b0a416c0-209e-400e-81da-987053b456f0/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4e66cc1e-f3c6-4852-8831-90a23cc68efe

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1752174

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Scheduled temp file as task from temp location

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b

Verdict:

inconclusive

YARA:

12 match(es)

Tags:

.Net Executable PE (Portable Executable) SOS: 0.41 Win 32 Exe x86

Link:

https://app.malva.re/file/6962ac2f17edee589dddf15214475713

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2025-08-06 01:45:27 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6xgqapihtvbhyl73qd6zc6eaqo3gwyskf2ww52fcsy5i7e5qob5q._file

Verdict:

malicious

Label(s):

agenttesla

unc_loader_037

AgentTesla

3bf577746fd479f9a7b91d7731999f2a3a2b8b8c6687f0df3d214dc1a871a5bd

AgentTesla

8bb52d0be263f9a7841a7a7537f0ac85fe5fe4b5bcc87d94663dce56ebad90dd

AgentTesla

b39f89613b1ff2a9d91959cad43eaca4f4c80988327324230b30717b71c0e3ba

AgentTesla

c9e1b0ef9cfac8e4e002a5609c366489564b246f633d0685fead77e46f7f7d61

AgentTesla

+ 3'440 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery execution keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/250807-k7mlzsyzfw/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

SmartAssembly .NET packer

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/89263e98-7879-4359-bf32-e5f353b89394

Unpacked files

SH256 hash:

f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b

MD5 hash:

6962ac2f17edee589dddf15214475713

SHA1 hash:

fdaec8fd7d55e1b4b04595e235c0b542b635582b

Link:

https://www.unpac.me/results/f62c8986-217c-411a-b814-1143bb3d9fb8/

SH256 hash:

b3df3b2c76f2c1d62a4e9da3cc6d3adf2a4c870ba703f5136532beb6c5800b5e

MD5 hash:

43a1201df30e3414a6070c362465a64a

SHA1 hash:

103b94b74e955251cc588c4e9533ebdae1106773

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/f62c8986-217c-411a-b814-1143bb3d9fb8/

Parent samples :

bb4fbfd0d632cea719766579d8f621be71c73db90897864722e0738d0a94d6b1
f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b
f75c114f83d3d078bd85e7e59cd8a4ed6e8be4a33db6600bd9eda842845ac2fe

SH256 hash:

9f278aa2f85b03974a640446d0605c39c23cebc0efe78d4dbec3297ac1c2149b

MD5 hash:

856458b3cafb49e15d9d4b7e9763ffd4

SHA1 hash:

3def092eabc842862ca4194d9781fa589df418f7

Detections:

win_agent_tesla_g2

AgentTesla

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/f62c8986-217c-411a-b814-1143bb3d9fb8/

Parent samples :

6c18d7057ece3ae1524782a51f4dfa5589128b5a4c695cf1d3b9f1b95169cc4d
1736cd52fdc1deacedeac1de86d461ceb01c476e307520762b74b67ca8fa4b4b
cc7ca4eb1a90642066ef9697165ceb0a12cb5b8498a198cbed5524cab5974e74
7df1b33f35a3ca87f9242153c847cc0d8e1d45c7e3b5c5ecf9f23bddbf94b052
d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3
372ef724cb2ba60abccfa7f0ac12e571059a3b28620a54a97a163a9b5a7205f8
59eced24086396408057708d32f922904341fca0cbd41884dc8e7359c3f50327
37c09235f5b6487dfc9689210d35b039a3ab2e74426c4284e4c7119269bc9104
a0b93473fe0aa4e5df49542aea136c8b037d85e4bae90eb5f55922e18ce6b804
720264d1cb886a1fa9bb5f807acf3677a82701e8e0fc25e65d03252bb7c8f69f
0ca149e59a526c1811fcac3c14943acdbc43a3261af653670bc9e71436b1fc32
df52744df9ff4bd8dfb0b6e6e86f94d1d885caba0f2deb2f8a429978b475508a
6be1f66c2715c6e4e9e535375607880080dd5a110326e80418d224b129aa50e2
2a64d3212309da646f5ef8210f6b8966c7a63ce82cb5bbd3c03838dd296badcf
4a7ce095400f7f3f613c9ea581084cb7756874d13301030b8955611a408dc312
357f7d8ce29a87629b8d9ab9230362cca864c3bb6a010e783290838d405626cb
f888c4770bbbbcad15c357d6731ff8f5afd7e62e4c35652f3dc3ede6c36b66e9
bbadbf3fdbbf1e1d3b0990bbd18ab566cc3028538d4fab8981d0f8505d44349a
2d09a6edc78299bdcb7c4094e75f30a334fb3cc53aa63529e22862f9f563b32e
e4bc932751053ca7710ced80639899db651a4addacf9c05811c0e8ab1842eb66
81bf08f12cdd41902982c5bfb43b2ebcc327a47e24d8d17a085349081138c1f7
489c3b4e65ec46019d1b57f2485c8862d3904e85994280a41d5271903386f07f
70a576a39497248cdc4e1510b0b210abc5c4fbc702fe00f69d4ed1f6f50ce7f8
ec81c38ff89da4f91aff94a7ae635adef1e8a4eb07f6ee5eb3f1908e33fb1a19
4aa035616ed50d2ca3d86455ef14e5c306d072b3942d25ce570b519b0cb142d6
00d76b06a5f9a7d23c7fc78c9f83b08d84e4a8a84e8da0a852ec0f6c5e65e771
0e4a730c64635bfe562af7d6e8c8fbea0e61a81780c2a3b9b562c550db5017ba
f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b

SH256 hash:

edb430107c4f532c84a21178de94f53f78b5b5609706e1591a02834abe8ca07c

MD5 hash:

c4f6373b7712e0ba8a96cff56feeee2e

SHA1 hash:

b6168c298e340c3b59afd8accc7c6110bd7cff38

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/f62c8986-217c-411a-b814-1143bb3d9fb8/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f5cd003d079d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	agentesla Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked agenttesla malware samples.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

tar 40c4f8262e9ddde99d1886b46877c2ceb8d54f8201aa6df97b1baa909dda0cb4

AgentTesla

exe f5cd003d079d427c2ffb80fd91788083b66b624a2ead6ee8a2963a8f93b0707b

(this sample)

Delivery method

Other

Dropped by

SHA256 40c4f8262e9ddde99d1886b46877c2ceb8d54f8201aa6df97b1baa909dda0cb4

Cape

https://www.capesandbox.com/analysis/19442/

Dropped by

MD5 d96b149f8cc3b709b65cd1b944ef2ce7

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample