MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 20


Intelligence 20 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb
SHA3-384 hash: 0e825dfa9138afa8e103e827ed1c68eaab5290acf148c147344b7cdf914ae909fd5b37e3440074c44c87dd4df422351c
SHA1 hash: 506a3d7122d56128e06dbd2c257fa47bc8f0ea48
MD5 hash: 74788528cf630956fc5bd644b35a1dbb
humanhash: texas-iowa-pennsylvania-south
File name:2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb
Download: download sample
Signature AgentTesla
Create hunting rule
File size:996'352 bytes
First seen:2026-06-08 09:26:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'011 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 24576:GPdM/PrEa+1pllozNMmKu6E7yMQAvoIy:udMLErroJMdJEhvV
Threatray 92 similar samples on MalwareBazaar
TLSH T1DC2512687615D11BC861ABB40D31F2B8073C5EAEB951E202AFCDAEEF7E71B059D04583
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 82cc69cc4dcccc44 (3 x AgentTesla, 3 x Formbook, 1 x SnakeKeylogger)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9b5a4c53-0bcd-43b8-ad16-1842c3fa1dee/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb
Verdict:
Malicious activity
Analysis date:
2026-05-11 05:52:38 UTC
Tags:
stealer ultravnc rmm-tool agenttesla exfiltration smtp
Link:
https://app.any.run/tasks/ebbf5be6-b710-4138-90e8-640a0c411017

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69771/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a268b45ae2f98c00a68c76c
Tags:
virus micro smtp
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a service
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt lolbin packed tracker vbnet
Link:
https://www.filescan.io/uploads/6a268b051f652d68656db8ab/reports/1bc98a31-e922-4b69-88e1-13f8cf69f4a0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-10T23:56:00Z UTC
Last seen:
2026-05-22T06:47:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7ff79286-fae1-423a-8ad4-7b9f5ca5870d
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1911402
Signature
AI detected malicious Powershell script
Allocates memory in foreign processes
Bypasses PowerShell execution policy
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1911402 Sample: hV4GOgJFvq Startdate: 11/05/2026 Architecture: WINDOWS Score: 100 43 mail.wwvvinc.com 2->43 45 shed.dual-low.part-0012.t-0009.t-msedge.net 2->45 47 10 other IPs or domains 2->47 65 Suricata IDS alerts for network traffic 2->65 67 Found malware configuration 2->67 69 Multi AV Scanner detection for submitted file 2->69 71 10 other signatures 2->71 8 hV4GOgJFvq.exe 1 6 2->8         started        12 powershell.exe 2->12         started        14 powershell.exe 19 2->14         started        signatures3 process4 file5 33 C:\Users\user\AppData\Roaming\gzqitIV.exe, PE32 8->33 dropped 35 C:\Users\user\...\gzqitIV.exe:Zone.Identifier, ASCII 8->35 dropped 37 C:\Users\user\AppData\...\ekvwt1rqwip.ps1, ASCII 8->37 dropped 39 C:\Users\user\AppData\...\hV4GOgJFvq.exe.log, ASCII 8->39 dropped 73 Creates autostart registry keys with suspicious values (likely registry only malware) 8->73 75 Creates an autostart registry key pointing to binary in C:\Windows 8->75 77 Writes to foreign memory regions 8->77 79 2 other signatures 8->79 16 MSBuild.exe 2 8->16         started        20 gzqitIV.exe 12->20         started        22 conhost.exe 12->22         started        24 gzqitIV.exe 3 14->24         started        26 conhost.exe 14->26         started        signatures6 process7 dnsIp8 41 mail.wwvvinc.com 31.222.235.198, 49715, 49723, 49724 GIGALIS-ASFR unknown 16->41 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->49 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->51 53 Tries to steal Mail credentials (via file / registry access) 16->53 55 Installs a global keyboard hook 16->55 57 Writes to foreign memory regions 20->57 59 Allocates memory in foreign processes 20->59 61 Injects a PE file into a foreign processes 20->61 28 MSBuild.exe 20->28         started        63 Multi AV Scanner detection for dropped file 24->63 31 MSBuild.exe 2 24->31         started        signatures9 process10 signatures11 81 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 28->81 83 Tries to steal Mail credentials (via file / registry access) 28->83 85 Tries to harvest and steal ftp login credentials 28->85 87 Tries to harvest and steal browser information (history, passwords, etc) 28->87 89 Installs a global keyboard hook 31->89
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb/
Threat name:
ByteCode-MSIL.Trojan.InfostealerTesla
Create hunting rule
Status:
Malicious
First seen:
2026-05-11 03:58:39 UTC
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ef2pgdjpncwj2as7t5xa6hba7hwl72pfzvh53lu4xpp3oy4nqxvq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
unc_loader_031
Create hunting rule
Similar samples:
301f45ab43a8e2bb80c54b6f4b5ba7b45b528b0b786a64fe40e8c3b4945baf3f
AgentTesla
49ba20cde2a94d0f765022fcb03f8f61b7ba7e3503a90c4b371c3b37c54f80dd
AgentTesla
90e4a4b341c0fc976c1832f1eed2ef6bbb0cc7635ff507ea574e7233c6655515
AgentTesla
920ab505745e5ca892fcbb46cae0996fc8f0d66059afd560d795800146a38a63
AgentTesla
ae9085760f4553683f57ddceb9ed30fd8dc3cd30e339d3e1c2b6dbb082d94873
AgentTesla
error
AgentTesla
+ 82 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260608-le6d3ab15v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb
MD5 hash:
74788528cf630956fc5bd644b35a1dbb
SHA1 hash:
506a3d7122d56128e06dbd2c257fa47bc8f0ea48
Link:
https://www.unpac.me/results/cd13adc8-44ca-47fd-98fb-96db06a82bec/
SH256 hash:
ccf46c2b6b782871ae730ab2dd12d96d8b8a167c36e8673767ab6d39a2f18f58
MD5 hash:
7be199615292f9d3636e17469625b536
SHA1 hash:
44a88d043be4e7294be4fefbd81f3c3d18e14546
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/cd13adc8-44ca-47fd-98fb-96db06a82bec/
Parent samples :
2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb
49ba20cde2a94d0f765022fcb03f8f61b7ba7e3503a90c4b371c3b37c54f80dd
90e4a4b341c0fc976c1832f1eed2ef6bbb0cc7635ff507ea574e7233c6655515
SH256 hash:
1c059186b06adc5569ce96e81c9d3b2242fa1bd0387666f37aa2605836a39bf9
MD5 hash:
12771648a4d8a251ca970689fe8675f7
SHA1 hash:
e34ddad540eb72098f7522055e0ef43d73a2ea3c
Link:
https://www.unpac.me/results/cd13adc8-44ca-47fd-98fb-96db06a82bec/
SH256 hash:
12f050eaa6648e1315a32a39cc55b86e2547890d306f1ee8dd5ce3d6d88c4d20
MD5 hash:
1f9ec5a51ced7af0f974838b3992b455
SHA1 hash:
fd335d4f6781337228131d4b5cd1aef966d167d5
Link:
https://www.unpac.me/results/cd13adc8-44ca-47fd-98fb-96db06a82bec/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2174f30d2f68/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69771/

Comments