MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 17

Intelligence 17 IOCs YARA 27 File information Comments

SHA256 hash:	12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d
SHA3-384 hash:	29fc0516a1f62e88cf2ea6a6d874962b7e1e49a23d0d05a31fb6920b5ba85eb0be4af200efe4ca86f26ff7a549fbd75a
SHA1 hash:	0ae1c3fe542d5013ecb12d4edaafe05198ad8772
MD5 hash:	44cf57e000471b20450faa87292e3693
humanhash:	mike-salami-winter-golf
File name:	12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	802'816 bytes
First seen:	2026-10-14 15:59:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'355 x AgentTesla, 20'857 x Formbook, 12'418 x SnakeKeylogger)
ssdeep	12288:pmicpoIZxXxcJ0b/RuN4AavB3cu9iK2lG6fDe+67SViwoHigaLq:cioNxcJ0LMNJaLiK29DfpVitam
TLSH	T18105F1582259DE06E4A36BF00970E7B417F45E856922C3478EFBAEE7BC3674668043D3
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	ShadowOpCode
Tags:	AgentTesla exe RGBLoader

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/82812ace-bd2b-4e1f-94ee-067e9658e443/

Malware family:

n/a

ID:

File name:

QuarantineMessage.zip

Verdict:

Malicious activity

Analysis date:

2026-10-11 06:24:39 UTC

Tags:

susp-attachments attachments attc-eml arch-exec attc-arch

Link:

https://app.any.run/tasks/406f63c9-cadd-432e-854c-743c4e9bf254

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/91864/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad162206f551121ba1662df

Tags:

shell virus micro lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a service

Creating synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Changing a file

Stealing user critical data

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

agenttesla entropy krypt packed

Link:

https://www.filescan.io/uploads/6acfa72e5fe91cc0f60368df/reports/e8e56bd4-6e3f-44c2-8656-38c451d926cd/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-07T05:56:00Z UTC

Last seen:

2026-10-16T00:31:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d/results?tab=lookup

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f2c933bd-58c2-4c4f-832d-cbde6234da64

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.22 Win 32 Exe x86

Link:

https://app.malva.re/file/44cf57e000471b20450faa87292e3693

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-07 09:05:55 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ckli3zgov337ae5d7x4xrdebp32jju4rsrnjndkxz7j4zjbqdnoq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/261014-tf3zbsxxf1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Family: AgentTesla

Unpacked files

SH256 hash:

12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d

MD5 hash:

44cf57e000471b20450faa87292e3693

SHA1 hash:

0ae1c3fe542d5013ecb12d4edaafe05198ad8772

Link:

https://www.unpac.me/results/702ce0d3-e3b8-4512-b26d-fdc0ce1493d8/

SH256 hash:

2d78b31edc11958dc9330feea1a02bf1a6a830472480455c758cdf22acce7183

MD5 hash:

db47caa808a6dd1b124681935b736b52

SHA1 hash:

4b3b8ea009efd300cb74aa1641f36eccdcc83aa2

Link:

https://www.unpac.me/results/702ce0d3-e3b8-4512-b26d-fdc0ce1493d8/

SH256 hash:

d4b398de0a87c2c75b007d5d37531502475c183374db0fa2a387e7fbc7232956

MD5 hash:

8c15c33ea3193cbab05f24141e65d924

SHA1 hash:

748e6ecdc1e5cfbc114d62b76322710aec927954

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/702ce0d3-e3b8-4512-b26d-fdc0ce1493d8/

Parent samples :

a21be069523269d370e173e5560617c4960e9cabfa03de22bd8fcae2c08e9e40
9262713395e980851638ce2f5bac67be989449f82d76e25d0ef42fa8e59c0863
0178f142fb4d44b716b5fdcbd83e324de8d2554014ef6d7c72378ee239bf363e
44c2f46e91c4b65b6f0c8385910af36a4255bba0fdd7bfccf2199e7a9faf19f7
07542948284356edd464a42312bcb8d55c6c6b9ab4920055d8aa62d229f6f857
12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d
2bf6f5c3980821264bc2f8e4ccd63dc770e770792596e7f7f88b4eb84cee9748
2a51b0fb96cbe3fe6815a23e70569747546e5717da1425773384ffe3fdf9a5c4
2c873a43b3c0ba3aaa6eb654333140e70bebfcba2b764a99842409fae9512c70
3323c04cb3604da5c475aca819d9c0c47f54e077426b08d1608a328202a9a1ec
4a0a42498fa15384cf6ab5f71f188b8d39bf63b41d7b148067191cd814dea8e2
4fa2289b4213bf093d4e100476ae25f553d3346d3729ad83f8e469f2cee49064
579adc1c3a92d159ddedc7162dce54f6b8d266c8d51cf0d7bf58197c40df538a
61a00b470fe310e7cf181535a14be6932f0cfdd5f66901bb8f477c8c6fd0b588
74cc8c583af59616b985779c4c764ebd27d5d1307555ed99a42480694857eeea
83dc792b38aa2f9b6f560bf9ef0a61e03f149df3572f577bca89eed4aa9fe9d8
86cd3bb88c1b2ca4558af1f153808a2cdabd55e00e4d32b6092f4b43feb0e866
8af6dbaac0340e2081b3b00b2d236e32a9310aef7b3596306a785050e3a3348a
a7fc92c7f72e1efb7a2a1eb11b0a80a8ef39e1aa0b44c917749eb93eed4cd481
b793cc108fc28c791ec625eef1abcf816fea99f339f6412f9d024f18ce0bd2d6
c70dcdf06ea84d43a6b204965f22e5a014205f92674f154b26c82fdbdab6f189
ef67dbacd2e262465001f6d3319b74d0f7a9bf2001f67951c8983d752b3af990
d5e02084e45d573719e8746b5d38af309305ecd55c3b8e263686ff9cd0275fe4
d8ee119c75a609bc3f729fbc78daca01af28da207bc23f7afc38d578df594406
7ac46ba0312041af8c2167ad287f37eecc71883b74d7f4f89f5ef2d20b95b68e
473f7259289f4599c4ede37b2c4069aff87097a74619bb150a35243a0b92620a
b6c7b5e85540e3821d9a77392b3099d1b3bf396af92570442ff954a8256c6b24
1cb079d0e0bc259faf900cd117d74a378a2a3680db8ebeb30b916785a948c140
beaa0c4fb75a7696bab03d04c34262a3d99d1724a0582ee9b158d1376b32e695
d5aa7618c50986f89d39ed65b1844f9f9950c22bae13f678903bb84cc6181e6a

SH256 hash:

d5f9c465b8324f8d80a7f2b0dbc61e717e104c68a0c50d8558148a2887132c24

MD5 hash:

94b020433a6deac504ee8564c92e24fb

SHA1 hash:

c844a21543f1a7924688b6b29616e175d7ab560d

Detections:

triage_agenttesla_infostealer

win_agent_tesla_g2

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

MALWARE_Win_AgentTeslaV2

Link:

https://www.unpac.me/results/702ce0d3-e3b8-4512-b26d-fdc0ce1493d8/

Parent samples :

12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d
525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
5e2515b0b3c5b85e44483e6e90b89eb6ff5969f326de13f5d111f192d85aae19

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DotNet_RGB_Embedded_AssemblyLoader_Hunt Create hunting rule
Author:	ShadowOpCode
Description:	Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	MALWARE_Win_AgentTeslaV2 Create hunting rule
Author:	ditekSHen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Generic_Threat_779cf969 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/91864/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample