MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 20

Intelligence 20 IOCs YARA 19 File information Comments

SHA256 hash:	269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233
SHA3-384 hash:	b3739996cb7c82363df772769e774b9ee50f80530199f2c2b7c75bcf7e6ba51f8e855fa5b40b0f2f658b1b175c592ae9
SHA1 hash:	bc760ca7ebe6d01c9f56911f6f73c6f1b02d3e24
MD5 hash:	2650e3012a002449d96c1d93956ecae7
humanhash:	beer-venus-kentucky-south
File name:	269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	927'232 bytes
First seen:	2026-02-05 15:26:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'795 x AgentTesla, 19'693 x Formbook, 12'274 x SnakeKeylogger)
ssdeep	12288:V29y7hqZuHR2ye5/qOSzhca53zn6zUSWqknCgeDwNgdzOhlmhZZI9/GCFGJFTL2B:V6uHR/e8luAn3etyfmhZzhJ9aP69QN
Threatray	3'615 similar samples on MalwareBazaar
TLSH	T165151290779AEB03C0D55BF40A65D3B52BB09E6EE820D3564EFEACE73135B5528843C2
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d8cdd732-669c-4780-bad8-d02938e6ca24/

Malware family:

agenttesla

ID:

File name:

_269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233.exe

Verdict:

Malicious activity

Analysis date:

2026-02-05 15:32:29 UTC

Tags:

agenttesla stealer

Link:

https://app.any.run/tasks/491f6210-0b49-409b-81e7-acf843c09a2a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/52040/

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6984b6ce117f8ed80109caf2

Tags:

virus smtp msil

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6984b6e1981ff1d38a4a07ef/reports/e171a625-f705-482d-b686-2def24b9df30/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-01-21T03:20:00Z UTC

Last seen:

2026-02-07T06:44:00Z UTC

Hits:

~1000

Detections:

Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agensla.sb Trojan-PSW.MSIL.Agensla.g Trojan-PSW.MSIL.Agensla.d HEUR:Trojan-Spy.MSIL.Agent.sb HEUR:Trojan-PSW.MSIL.Agensla.gen PDM:Trojan.Win32.Generic Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb

Link:

https://opentip.kaspersky.com/269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233/results?tab=lookup

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e1161bc0-15a0-44d9-a6af-1a36991e4437

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233

Gathering data

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233/

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233

Threat name:

Win32.Spyware.AsyncRAT

Status:

Malicious

First seen:

2026-01-21 07:31:56 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=e2o6bzsrsabg33k6y6zke7fgkvzcyed3zktqol5qtkbeb7zjyizq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

39e885110ea41b64da0597e267754cf951b6932d52a956e47d35e3fbcdbf0281

AgentTesla

3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a

AgentTesla

6d9b7e45f0ac13266800021b0ed41d95a69746f2596511680223525bb1fde745

AgentTesla

eb87b3dc43401ecf721197d64f818cd03e9283f04d02eb2ca4680c3356f29fcf

AgentTesla

+ 3'605 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260205-sv2t5sat9a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

SmartAssembly .NET packer

Suspicious use of SetThreadContext

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Agenttesla family

Unpacked files

SH256 hash:

269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233

MD5 hash:

2650e3012a002449d96c1d93956ecae7

SHA1 hash:

bc760ca7ebe6d01c9f56911f6f73c6f1b02d3e24

Link:

https://www.unpac.me/results/6733c7ca-707b-44b7-9965-ad2b48200c78/

SH256 hash:

cd2635e28e599c9237689671674b7680de7654b2476af26529006dd2c1865dd2

MD5 hash:

5c93bf5842307d689e86966815f1d0d1

SHA1 hash:

692827c2cadb0a012ee293811677d1e07be4ed61

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

Link:

https://www.unpac.me/results/6733c7ca-707b-44b7-9965-ad2b48200c78/

SH256 hash:

4c1c565207f0075b849c8069918d3acd1561ccbb6f2aef7073d45de6dab29452

MD5 hash:

3d6fd4cfb478847ec5b4e1a18fd7e5ab

SHA1 hash:

6cdf4a9f2139b11944a4333e520315233b67d5df

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/6733c7ca-707b-44b7-9965-ad2b48200c78/

Parent samples :

6b76f76b9ed250c6fa30cd2bb8228329829c4fac161dcd1058b7a640bffd2601
60ef1afae839bd774d59f78c2866dad57a397db6f1c3a8432d3daa39985e040c
470ce68595ae8ca768012d0ec974f0099d2bfb4995d6d8547df82c7186752853
98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
13d86cd98fa20c90ce941d9e3088a00abef85faed0695ca7bcf3434a704dd810
269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233

SH256 hash:

53e615a93c170a604a8f43d138347a0979f9ae9d9b23d5dd4c3bb73eebab14ec

MD5 hash:

b65af239e5a675657992fdc7245dcfe3

SHA1 hash:

9867e1fd642d01873a9ccdcc2361d5b658fda450

Detections:

win_agent_tesla_g2

AgentTesla

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/6733c7ca-707b-44b7-9965-ad2b48200c78/

Parent samples :

e6d21c7f70042be1e6ebd793d468b6ed3b7303bb1ebea404f1853367da412fa1
505addcb02a473a950e2fc346435bdddecdf539b8719ce3ee9debc7970ac55d3
269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/269de0e65190/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/52040/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample