MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57
SHA3-384 hash: 0864b3995f09aaf655373b275d5a8d37badcda60a8dff6ad6d0cb06a1c36d5183d032271cfc4fe1cb54d5712ebf34279
SHA1 hash: 97f4e16e91650030116596f3895c1afa524a7f26
MD5 hash: 2d7a561a5da8bc8a2be9e28a04060cb2
humanhash: winter-earth-autumn-blossom
File name:Conveyor belt - drawings.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:832'512 bytes
First seen:2025-07-09 03:45:49 UTC
Last seen:2025-07-09 10:18:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:RKFAkO9AFtK1fZXB6D9lQ5cTrN/1fbMP6yCRFwmVS5R3Ay48QEJ4H444t:rkQCtKjBosgNfbM4/Ig8B4H444t
Threatray 3'423 similar samples on MalwareBazaar
TLSH T18C05D0626F00F432C811BFB55359E374D22B5E84A412DB865CF9BEA739E56C23F87182
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 36c29292b2e88c82 (54 x AgentTesla, 33 x RedLineStealer, 11 x Formbook)
Reporter threatcat_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
_2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57.exe
Verdict:
Malicious activity
Analysis date:
2025-07-09 03:50:24 UTC
Tags:
evasion auto-sch-xml stealer ultravnc rmm-tool netreactor agenttesla
Link:
https://app.any.run/tasks/488b4bd2-0e20-423c-a519-ea6b3efb0cf8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/13621/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.26245.8083.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686de613900df8e7f868d03b
Tags:
underscore micro spawn msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Forced shutdown of a system process
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bitmap masquerade obfuscated obfuscated packed packed packed reconnaissance roboski stego vbnet
Link:
https://www.filescan.io/uploads/686de611771e207d04869bc8/reports/8d236ded-0909-4083-9522-b74c9934b8ba/overview
Verdict:
Malicious
Labled as:
Strictor.Generic
Link:
https://www.hybrid-analysis.com/sample/2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1bff81a5-8b55-4d7c-8e4f-f308d772dbc5
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1733648
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Double Extension File Execution
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1733648 Sample: Conveyor belt - drawings.pdf.exe Startdate: 11/07/2025 Architecture: WINDOWS Score: 100 46 smtp.yandex.ru 2->46 48 smtp.yandex.com 2->48 50 api.ipify.org 2->50 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Sigma detected: Scheduled temp file as task from temp location 2->60 62 14 other signatures 2->62 8 Conveyor belt - drawings.pdf.exe 7 2->8         started        12 NmoazRrHck.exe 5 2->12         started        signatures3 process4 file5 38 C:\Users\user\AppData\...38moazRrHck.exe, PE32 8->38 dropped 40 C:\Users\...40moazRrHck.exe:Zone.Identifier, ASCII 8->40 dropped 42 C:\Users\user\AppData\Local\...\tmp1AC8.tmp, XML 8->42 dropped 44 C:\...\Conveyor belt - drawings.pdf.exe.log, ASCII 8->44 dropped 64 Adds a directory exclusion to Windows Defender 8->64 14 RegSvcs.exe 15 2 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        66 Multi AV Scanner detection for dropped file 12->66 68 Writes to foreign memory regions 12->68 70 Allocates memory in foreign processes 12->70 72 Injects a PE file into a foreign processes 12->72 24 RegSvcs.exe 12->24         started        26 schtasks.exe 12->26         started        signatures6 process7 dnsIp8 52 smtp.yandex.ru 77.88.21.158, 49716, 49723, 49726 YANDEXRU Russian Federation 14->52 54 api.ipify.org 104.26.13.205, 443, 49713, 49721 CLOUDFLARENETUS United States 14->54 74 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->74 76 Loading BitLocker PowerShell Module 18->76 28 conhost.exe 18->28         started        30 WmiPrvSE.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        78 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->78 80 Tries to steal Mail credentials (via file / registry access) 24->80 82 Tries to harvest and steal ftp login credentials 24->82 84 2 other signatures 24->84 36 conhost.exe 26->36         started        signatures9 process10
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.02 Win 32 Exe x86
Link:
https://app.malva.re/file/2d7a561a5da8bc8a2be9e28a04060cb2
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57/
Threat name:
ByteCode-MSIL.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-07-09 03:46:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fotvjifmevmf5jlqy6qwo2uebx6tjm4vr2nupm5y6bie4dhv55lq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
08379da65d80bac62f2bed130768e19210cf2344f74845a977fb8fa8237fb43d
AgentTesla
2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57
AgentTesla
b96cfca8ea3bc4fe132e029f2743fed9d30592d6012b4fe829180a2c1457f4f1
AgentTesla
bdee1f00bac8c820656feaa0a14878285a46cddff586e81080b1eb3f0672d622
AgentTesla
ccadaf700c4557efd158b2578d62710414c288b13d1c7a1eec1b06957ea8837b
AgentTesla
error
AgentTesla
+ 3'413 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/250709-ebtgrsbq7w/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Command and Scripting Interpreter: PowerShell
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/17b6c22a-a37f-41af-9ca5-84ddbe1b7a7b
Unpacked files
SH256 hash:
2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57
MD5 hash:
2d7a561a5da8bc8a2be9e28a04060cb2
SHA1 hash:
97f4e16e91650030116596f3895c1afa524a7f26
Link:
https://www.unpac.me/results/b8d4a9d3-51f1-4240-b947-18d6ffdc271c/
SH256 hash:
4ec0efc1ce9f13bf27aa26f47ff4df8328afab446480351f4e80fae0af1a96db
MD5 hash:
13bf51bcafce7de31bddb3798ed0054c
SHA1 hash:
1af13ddc133ed17526a4a41588728b234d85f4f6
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/b8d4a9d3-51f1-4240-b947-18d6ffdc271c/
Parent samples :
2bad79c92d04ba6aaad1bd335172582ab7c6b1a8e74673218842e247e70e673c
bb677ab79485ce6a96408eeab34427508dcf5ddf8f545e4405c71558b9a2016a
99baf9d5c23c9279310f7d426f1ec530acc0bc11894110bc96ce106c44758c10
7fecbeb83cb5c4a4cd454ef5053c7213c120b1112d338b90a9acd098a3ce3906
fa6addc3633d1cbd0cfbcae6fa5b8001a99ae9c76a49a46bd856bd6e69501aec
cf2e7b9acbfbbdd7fe69beeea53825b9df2afe3a4d00adc7042e81ee1c818d4c
aabbc82a677b1e9f26a0f7d1704889fa159bd24df7ffe9b937bdb8a922b09857
9906fd0da3bdf865ad1aa6e39670efae4ae1f9518971dbe8757d7d3b5e0f4d39
f9d286e5a30f62164bffaf413159ee0a3a2f3817f0100f72d24c1e86050dba20
59b75850acebc2f27f682fd4a67c0633552e1b32c4086a32963953b5eef4edb0
be28d0c5c726eac678f6db3a47a13e46bec770e52e596d119223ae82026ee83d
e6c14e992a954123183e8826d8004d890ed4f5f3b9899901a4a9965275424033
2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57
3d5c6d39c05f201d05895f0f360cb80e7c1a6aae3e5dd1f6fdf1c4adc2b01971
5f617bb27f357a5a7ecaeccc30a9940c0299f419c655848775ff126f42cf2dff
6bafaa1d8eb2ec2fe28a3eebc5a90a24240ac8b855ec2ade615e7d6e9f737c93
99a2e944a43b8570684560b58c39ad2b64cf59b8d4f03e0ebd963f7911a48884
a6bc5543545f08dc991f050b55476a159665bb889f3a7e88527c86a8684c38ec
360b4b87d98a9e75a56ee1dd3adfbf1a017ef575bcc63c89fb556933eca33837
SH256 hash:
0b76ceb1acb7d9fb37b35e710b1cf9dd56c5f1a6a41e7116c425885f31391c27
MD5 hash:
9b90488d09f201e7e33a0702efe7f869
SHA1 hash:
3588a29d20b72bc264d3c1081b297cea68d3064b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/b8d4a9d3-51f1-4240-b947-18d6ffdc271c/
SH256 hash:
38b7bd95b2e31924529d4858b0cb7689be3c5835d7dd1da7c976c790b290ed6a
MD5 hash:
fc0122bc4af85e901f8cc57c0095bb8b
SHA1 hash:
49d231a0b84016e54743fdb1dce1c948bdc07b9b
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/b8d4a9d3-51f1-4240-b947-18d6ffdc271c/
Parent samples :
4213099d8b57762fbc31774f8db657ac6aedb0498af8bed11d17eb81cfcf7be9
2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57
a3721fdc1d4f9179cec068cac23a723fdf2bba91ab354811266d90defbcffc1f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 2ba754a0ac25585ea570c7a1676a840dfd34b3958e9b47b3b8f0504e0cf5ef57

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/13621/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments