🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 21


Intelligence 21 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21
SHA3-384 hash: 51f3e3482f5a726cc3c5164d64750d79ef881ecb8ca5429ce72ca012dcc7d40ea679dcc074c9bc55f35e58e56c610e5d
SHA1 hash: ce1cdc7b93e9b7db351947afa0bd9ee188857c7d
MD5 hash: 25b343479b27442cd83dc17bbe7f2a4d
humanhash: happy-sweet-salami-purple
File name:transferencia interbancaria (BBVA).exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:942'080 bytes
First seen:2026-06-04 13:33:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'239 x AgentTesla, 20'493 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 24576:G7v9KB4FjCrObFtcZXpljwTpHEQCvoGF4YD:v4FjCabFq1pidHOvvF4
Threatray 1'599 similar samples on MalwareBazaar
TLSH T18B1501251C863688CB7F0F78C06319A877F0D80791E6E7693EEC11F9AAE3745CE16952
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
DeepSea
Details
DeepSea
DeepSea decrypted strings
Link:
https://research.acce.ciphertechsolutions.com/results/d95b53fe-cf42-4b72-b630-fdbd6698703e/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-06-04 13:33:49 UTC
Tags:
netreactor stealer ultravnc rmm-tool
Link:
https://app.any.run/tasks/e2c70fcd-5957-4ed7-8baf-fc07d0cd92dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68989/
Detection(s):
Win.Packed.Malwarex-10059342-0
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a217ea057b7bf261d60d532
Tags:
micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 obfuscated obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6a217e9d4bb6e36d180b5d58/reports/1e6da767-3669-4147-9376-fbd8c48ecfe4/overview
Verdict:
Malicious
Labled as:
Trojan.Mardom.IN.Generic
Link:
https://www.hybrid-analysis.com/sample/2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-04T09:26:00Z UTC
Last seen:
2026-06-06T10:51:00Z UTC
Hits:
~1000
Detections:
Trojan.Win32.Inject.sb Trojan-PSW.Win32.Disco.sb HEUR:Trojan-PSW.MSIL.Stelega.gen Trojan.MSIL.Inject.sb Trojan.MSIL.Inject.b Trojan-PSW.Win32.Stealer.sb Trojan-PSW.MSIL.Agensla.sb Trojan-PSW.MSIL.Agensla.g Trojan-PSW.MSIL.Agensla.d HEUR:Trojan-Spy.MSIL.Agent.sb Trojan-Spy.Stealer.FTP.C&C Trojan-PSW.Agensla.TCP.C&C PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1b2f7eaf-9c6e-43e2-aa9a-146fc48d0f4d
Result
Threat name:
AgentTesla, DarkTortilla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1923005
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-06-04 12:20:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eauyogzw4nvxe6zak7zr6w5oylbnawuglv3wgobbjew3zgrzz4qq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21
AgentTesla
3b3c396524c4ddb98941fd82d0881b2c5babd388df42ec13abb6223a5fafc38c
AgentTesla
9c01cfdbe35631129e75e76565294dadc83d2264f3b979ec1afa2d0d0eaac514
AgentTesla
c98b4dd7d6feffcbd72c39b272cc3b829aa1b92f9ae27c29c2a68abdc1bef4a6
AgentTesla
error
AgentTesla
+ 1'589 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/260604-qtk4wsfv4v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
.NET Reactor proctector
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Family: AgentTesla
Unpacked files
SH256 hash:
2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21
MD5 hash:
25b343479b27442cd83dc17bbe7f2a4d
SHA1 hash:
ce1cdc7b93e9b7db351947afa0bd9ee188857c7d
Link:
https://www.unpac.me/results/3f5e434b-ea8e-47f4-b4a0-3c71c2e619d9/
SH256 hash:
ac400b0769b063f91614a07bc119bc5b44e5237064870728b449036dcc4b67e1
MD5 hash:
85908e3e3270b1cc66d4350a44411d31
SHA1 hash:
46ee969e0851ba17e735345aefcdc0816f2b7c57
Link:
https://www.unpac.me/results/3f5e434b-ea8e-47f4-b4a0-3c71c2e619d9/
SH256 hash:
bd343c351601819d9fa3626ed622bd593e168a9a642ac3d490d3414a87f205db
MD5 hash:
e757fe46f296318775f854bb69859c57
SHA1 hash:
960fde472ef17d68f9b3e84acb998ec491d16a4f
Link:
https://www.unpac.me/results/3f5e434b-ea8e-47f4-b4a0-3c71c2e619d9/
SH256 hash:
bbd8661b84f4ed8a0f56cc25111806a7c7e4b33d08cdf7464da1ee027d04f945
MD5 hash:
69ce22d288bbb1e58194210a2aa04107
SHA1 hash:
dd2dad3687910cdbba0dfd2edb98e4a2d336b429
Link:
https://www.unpac.me/results/3f5e434b-ea8e-47f4-b4a0-3c71c2e619d9/
SH256 hash:
79d4000aac604c62607e326148a644258e46c168675ee982651517bec9bbdb69
MD5 hash:
c3042b407753183e49d93957755edfa5
SHA1 hash:
fed1018c06368f903e0ed496d719a69e225c71a0
Detections:
win_agent_tesla_g2
Create hunting rule
triage_agenttesla_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/3f5e434b-ea8e-47f4-b4a0-3c71c2e619d9/
Parent samples :
9c01cfdbe35631129e75e76565294dadc83d2264f3b979ec1afa2d0d0eaac514
3b3c396524c4ddb98941fd82d0881b2c5babd388df42ec13abb6223a5fafc38c
2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21
2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2029871b36e3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68989/

Comments