MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536
SHA3-384 hash: e1fc2e47e2c46396ad59bb6ccc21dfcd33c485a1d0b3bed4fe62f158c4d37503f3adca8b12f46dd73f13c24031a7c83c
SHA1 hash: b6f1d854a1346fd8b2870a4e64bf865fa55212e8
MD5 hash: a8f7de686ac1cbcebe22bf17ef2e85a3
humanhash: twenty-emma-emma-mexico
File name:052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'036'288 bytes
First seen:2026-08-10 14:39:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'190 x AgentTesla, 20'337 x Formbook, 12'364 x SnakeKeylogger)
ssdeep 24576:ecCp50zkogy/qk9fq9AZf8caPbwvcZRF0y7C4W8CGzPK2lII8:ecCp5kykeAZf6DMcZIy3CGzPKYII
TLSH T14425F104235A9A42E0E6CBF2BDB0E37033641DDF78E2C29A5FE95FE778293815454792
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
47
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e1afb286-68aa-40d9-b635-72feca265fa7/
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Launching a service
Changing a file
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
entropy packed vbnet
Link:
https://www.filescan.io/uploads/6a79e2e55ca504a8496e31e9/reports/154ddc39-e396-4bc7-a70e-c348a81684e0/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-21T13:18:00Z UTC
Last seen:
2026-08-10T09:57:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536/results?tab=lookup
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 23:51:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 36 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=auxea5tygealp4fn4xfklevc3fhsgcl5hp4vtpjvhwb2rwrsou3a._file
Verdict:
malicious
Label(s):
AgentTesla
Create hunting rule
Link:
https://reports.threatray.com/f8425e9c-1d98-4679-a856-c926ea3056a0
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery evasion execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260810-r78yjsgh56/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Modifies Windows Defender DisableAntiSpyware settings
Unpacked files
SH256 hash:
052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536
MD5 hash:
a8f7de686ac1cbcebe22bf17ef2e85a3
SHA1 hash:
b6f1d854a1346fd8b2870a4e64bf865fa55212e8
Link:
https://www.unpac.me/results/6035aee5-165b-46b1-8516-f2b3cc4a90d4/
SH256 hash:
e4e98c56847f65b0ec79dd0fcd73f780be8e5b64a78def50b3d447c6a22aab6d
MD5 hash:
3e279146474e41a20e10d71196dea18c
SHA1 hash:
c3abd761f47fc10a6e546d214517de85e1cb64a0
Link:
https://www.unpac.me/results/6035aee5-165b-46b1-8516-f2b3cc4a90d4/
SH256 hash:
7c7e910cbe5a35a467f3b8fa1f7061074e8e0fb907b82821d1e6202f49673c23
MD5 hash:
b23a1e718dc516b39032e683eac4ebf0
SHA1 hash:
f47ed52ae1e17489966c9b07a57e160b019b664a
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/6035aee5-165b-46b1-8516-f2b3cc4a90d4/
Parent samples :
679e3b146fe4ae9eb288b02f61958fedf2b454f843ed2ca61f620ad789dd32be
5b0296ef10e31e1662174fe51e89dd11326bea63efa085580518db2c681ebd59
b7c70cd300732d7faad3e5a898a93b0dbff2a62ec9555eef0997af34baa721ca
7da29ed5d5ef8e13d8b5631ea4d2868d71721dae0297b260573a877bad180528
916826c3e3c7c235a5d7b88cb905fcf1fc18b0d90665b75522be12189be1680c
1829a5b49d1c30ac6271ab38f248aecc37c40c8fb1cca0ed2b395e94bfe27b86
d097aece3afaf2eeafce3fea88dc99e98ef31465bb9216fbc4bbc0c649dea94c
f972bbbdc84e41e308feb7a58da0fc5783df3f592979ffd49116290e35dd6a04
3548aa0ee0cecf920604b5d5d5c231f2a5241a012548198402e6121a43ef55f7
229522055e3df0433500a4ca4cf2a302af1552be316018021e7347019cc86e3f
ee9ed4987fb571fe5694f7b4d56b722c2b9c7d4bdd390c405a97b8a907405ebd
fd8d2c0d431ab7af219f5b80444547e06e652ed6ebfdb538e17f5d30d39c9803
6bc3fb9dea42b005f4c25fa37b42339dead7713416919e400a5d01b98046d197
f0695b975e0e13218720fb19aeead0d365d7dc99ac0d32d8b0227a3224cf56f5
3d23669e6b8b3c81723e8d708f6b96775438190207a7ffc2b3250dc8ad9b6d1f
4cc4ef1db310f70a8f0a7b8c316e7701ffbe9086d75d5bec6f7a8cae9502ce54
f31920ba7bb3d9a49382e06cfe13eddee4c4375cacd93c74794f1c7ec342c707
052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536
SH256 hash:
7a622cf9b5e7d0ee523bdf5aa6162e4714dda80a35d1f34ecfe8de88b7f99637
MD5 hash:
f92ce1810dfe046d034ad4eb4bc12dba
SHA1 hash:
fb054f22900efb95085dde951f5b2eb03585f55d
Link:
https://www.unpac.me/results/6035aee5-165b-46b1-8516-f2b3cc4a90d4/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/052e40767831/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79964/

Comments