MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4
SHA3-384 hash: 0b9a3b743b4adae176106f9f7dba008faa637da723eba70a539f122b798882d3bdf4ed708171f9eec2833203a5f4e000
SHA1 hash: c00dd4a692e4f4fcf0617df421a8f207901d6d05
MD5 hash: d1616ef271b5ce924f5f360b23e84a71
humanhash: washington-five-football-sixteen
File name:330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'241'088 bytes
First seen:2026-03-06 14:33:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'845 x AgentTesla, 19'778 x Formbook, 12'302 x SnakeKeylogger)
ssdeep 24576:HguQKHuotDYMoLrTY9tzfkNUd3exBfeKMhke4m4Vict2:Au/7tDmrT+twed94m4Qc
Threatray 3'582 similar samples on MalwareBazaar
TLSH T1D8452324235DCD87D46C97F50425F37293B88E6A6521E38A8FED7EEF7419B42A818343
TrID 25.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
25.3% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win32 Executable (generic) (4504/4/1)
8.0% (.ICL) Windows Icons Library (generic) (2059/9)
7.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c79d4a91-7eaf-4d39-9d93-2b9b0259c67a/
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/55852/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69aae5cee1f958bf66848069
Tags:
agenttesla lien
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-11T04:16:00Z UTC
Last seen:
2026-02-13T12:41:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cbe341f4-d27e-48d2-bb31-66e36e1ac205
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.13 Win 32 Exe x86
Link:
https://app.malva.re/file/d1616ef271b5ce924f5f360b23e84a71
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-02-11 07:44:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gmfktnqa2fsgfwe7otyg7ixywgjtud3cumrb4ecdoih5xq2mk72a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
13aba9fcbf2494eb657177fbe83279c1313e7791f1086d9d1460cb66b5eff4e5
AgentTesla
31dd3e8d2700af11c4a5e14defb93a8ef1891f8801d6e8bc5ed35e106a072e64
AgentTesla
56e0cfc0fb789f7d8d7cef0b8497eef95563f46bb383d5f38061347657eaa445
AgentTesla
6d9b7e45f0ac13266800021b0ed41d95a69746f2596511680223525bb1fde745
AgentTesla
87c9b23d3ac3e48910f9d204708f95d337fab4161b5fc8a9a32735cfe7b8d83d
AgentTesla
a89d88037e6e7321b7da02290aab0139ddf7be1b697388dcc28fba708304682f
AgentTesla
eb87b3dc43401ecf721197d64f818cd03e9283f04d02eb2ca4680c3356f29fcf
AgentTesla
f11026574c1ad05a8eb43f8a267b8dc11ce7f981f32a4c72f0675e6141e898f4
AgentTesla
+ 3'572 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/260306-rw21vsgv2k/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
AgentTesla
Agenttesla family
Unpacked files
SH256 hash:
330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4
MD5 hash:
d1616ef271b5ce924f5f360b23e84a71
SHA1 hash:
c00dd4a692e4f4fcf0617df421a8f207901d6d05
Link:
https://www.unpac.me/results/d7ff4728-1d01-4549-b536-f5e8f7f45696/
SH256 hash:
48fa91de316a3b8b9b173548ff297a529e8045cfba133655cb8d7bf2517df628
MD5 hash:
54f2d8dcde429e9fa2c0cef39b6bb0e7
SHA1 hash:
1b0181a02d9f36613fdd5170d1b84a5a8358b2af
Link:
https://www.unpac.me/results/d7ff4728-1d01-4549-b536-f5e8f7f45696/
SH256 hash:
322914f3c0ef95d6e10c742a56c4340d8c938003aa46ecb2d352f1c9510711ef
MD5 hash:
4420fdebe8c9b316c29ef615fdc61c58
SHA1 hash:
1dd16507de701ea2d26e08f6612196c7bffa3e47
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/d7ff4728-1d01-4549-b536-f5e8f7f45696/
Parent samples :
b2c55968ebfa683dde47a788acb0cea62d164be955460d11c8fb2bfa21004311
3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a
ea05c40903621dfaf656dc4a993aef38112bfe54588f08675ad504e96b4b5a52
0821ab66a63ff2fe4d38a825b7ff3c3104a89eeb88df640d3a705b95b634bf53
330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4
SH256 hash:
f2154c6feb2ef6928de3e6887e6a601bd08d134b3f1a45ad95c437f6c026e5d3
MD5 hash:
ce49e833ddd8129c798de1dcd8441a61
SHA1 hash:
e9a69b24f50d2fa397dabff65a67d0937fed1518
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d7ff4728-1d01-4549-b536-f5e8f7f45696/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/55852/

Comments