MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b8c01872f5f8f7ea0056e521a82f5563a8dd491eb75be2450aacd301a4ee6454. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 18
| SHA256 hash: | b8c01872f5f8f7ea0056e521a82f5563a8dd491eb75be2450aacd301a4ee6454 |
|---|---|
| SHA3-384 hash: | 474ce4761ea6d06004acc84a0e3c1c12844fda29b8267eb43754360d4fdd2ff58b0357ccb9485a6d13382706fb36466e |
| SHA1 hash: | 576766a9c2175d3bd4bbc4b08872c26608265fbc |
| MD5 hash: | 7f699e3847a09bd4182f714dca834510 |
| humanhash: | alanine-cat-jersey-autumn |
| File name: | techno POORD035338.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'057'280 bytes |
| First seen: | 2025-09-08 22:33:20 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:0+Szx+WO4Kp7YXRyX9Tgb5eqzu/B2BCa0dEgJqo:RSzx+94Y7YOcb5ez/c0a0dE2qo |
| Threatray | 948 similar samples on MalwareBazaar |
| TLSH | T19F2523B857680933C1F5C97D76D27114DA34A097C2EAFB829480917E2F6B7E1C827E87 |
| TrID | 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| Reporter |  cocaman |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
101
Origin country :
CHVendor Threat Intelligence
Malware family:
agenttesla
ID:
1
File name:
techno POORD035338.exe
Verdict:
Malicious activity
Analysis date:
2025-09-08 22:34:09 UTC
Tags:
auto-startup stealer ultravnc rmm-tool agenttesla netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Detection(s):
Verdict:
Malicious
Score:
90.9%
Tags:
smartassembly autorun packed spawn
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
obfuscated obfuscated packed packed packer_detected smartassembly smart_assembly
Verdict:
Malicious
Labled as:
Trojan.Mardom.MN.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-08T05:20:00Z UTC
Last seen:
2025-09-08T05:20:00Z UTC
Hits:
~1000
Detections:
Trojan-PSW.MSIL.Agentb.sb HEUR:Trojan-Spy.MSIL.Agent.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agensla.sb Trojan-PSW.MSIL.Agensla.d PDM:Trojan.Win32.Generic HEUR:Trojan-PSW.MSIL.Agensla.a HEUR:Backdoor.MSIL.AsyncRat.gen Trojan.MSIL.Inject.sb Trojan.MSIL.Dnoper.sb Trojan.MSIL.Agent.sb VHO:Backdoor.Win32.Androm.gen Trojan-Spy.Agent.SMTP.C&C Trojan-PSW.MSIL.Agensla.g Trojan-PSW.Agensla.TCP.C&C Trojan-PSW.MSIL.PureLogs.sb
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
AgentTesla, PureLog Stealer, ResolverRAT
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops VBS files to the startup folder
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Drops script at startup location
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected PureLog Stealer
Yara detected ResolverRAT
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.43 Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Threat name:
Win32.Spyware.Negasteal
Status:
Malicious
First seen:
2025-09-08 09:03:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
30 of 38 (78.95%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
unc_loader_001
Similar samples:
+ 938 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Drops startup file
Verdict:
Malicious
Tags:
Win.Packed.Msilheracles-10017859-0
YARA:
n/a
Unpacked files
SH256 hash:
b8c01872f5f8f7ea0056e521a82f5563a8dd491eb75be2450aacd301a4ee6454
MD5 hash:
7f699e3847a09bd4182f714dca834510
SHA1 hash:
576766a9c2175d3bd4bbc4b08872c26608265fbc
SH256 hash:
ce1196ee2ab042474c4d3a61a73a0e0ec59f9cfbff65734c346d6af2fafa8c9e
MD5 hash:
c3e2c886aa7d3bff382f8f69bbdf02db
SHA1 hash:
160ab98e1e694dec8dd6ebf09c0f7ac68a13cc41
SH256 hash:
a77a95ae282ecd575aeb6fac3a81510a1cab24eefe8d3bf65288ed1c4b78bf91
MD5 hash:
bbf312db9312d66b589b9f4e678c0058
SHA1 hash:
187ce9daf72e87b26be1902d641ab321e4a68551
SH256 hash:
ee96b252efd97bc501542002dfcc4ce73c6ba787795e2463e1f5303830d4367c
MD5 hash:
489904e5305b61caf1679c76c34550dc
SHA1 hash:
797e71fcbfbefd955fc435ac7f87541446665c53
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
d1d85427e023b52ef305063b707f12287a4c258b54c088c1d9e02419e1b782e1
MD5 hash:
ef3da311eb996de1cb9932ef9546d63e
SHA1 hash:
9bc70ef6ee37e579da25f5600c7328ab5b01ddb7
SH256 hash:
c2dd6d2b812932e68e82f4d9854291c2b43071854c28fda768001b0d56188203
MD5 hash:
c2a39d867d5c52cee06fa0e4a0ca92dc
SHA1 hash:
ffa7af534ed16bc3476aa9956ccc2753433a05e1
Detections:
win_samsam_auto
SUSP_OBF_NET_Reactor_Native_Stub_Jan24
MAL_Malware_Imphash_Mar23_1
MetaStealer_NET_Reactor_packer
MALWARE_Win_RedLine
Malware family:
RedNet
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CP_AllMal_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | INDICATOR_EXE_Packed_SmartAssembly |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with SmartAssembly |
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | MAL_Malware_Imphash_Mar23_1 |
|---|---|
| Author: | Arnim Rupp |
| Description: | Detects malware by known bad imphash or rich_pe_header_hash |
| Reference: | https://yaraify.abuse.ch/statistics/ |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | win_samsam_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.