MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 20


Intelligence 20 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a
SHA3-384 hash: 0d0187c30791633ff70600f6a8de2d1871450d4cf088bdd2f3b82a40150d0c5aa5c1e4788c72f3cfa0d0852f1fbf2471
SHA1 hash: 1594806a529f15b39b687e75f4382a6220a52105
MD5 hash: f1a584562bde9a0b6814c9bfd5b092b5
humanhash: music-bakerloo-iowa-shade
File name:rOFFER14861-VGW0386814844_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'151'488 bytes
First seen:2026-02-05 08:00:13 UTC
Last seen:2026-02-05 08:26:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'845 x AgentTesla, 19'778 x Formbook, 12'302 x SnakeKeylogger)
ssdeep 24576:qguQ5Y9WeirIjHsQW/qiQRZWqv0JFBI4huyDQqsM6e3C7kNOZgxc:juwnryWyiQ7hvIBXuy0qsM6e3C79Sc
TLSH T173352352339DCE4BD0520BF92271D33053B58D2AE842D267CFEDACDFB916AA12569307
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter FXOLabs
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
160
Origin country :
BR BR
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/194d90c5-69af-45ce-a2ba-5dcfdfb8e3b3/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
nOFFER_14861-VGW0386814844_pdf.z
Verdict:
Malicious activity
Analysis date:
2026-02-05 08:01:13 UTC
Tags:
arch-exec stealer ultravnc rmm-tool agenttesla
Link:
https://app.any.run/tasks/2712ccbb-1e54-46ac-9bfe-1b27f333068f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51770/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.44827421.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69844e2c8ce611733c0b283d
Tags:
underscore lien
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed
Link:
https://www.filescan.io/uploads/69844e27930564ff3c8c2ca5/reports/d3b877f9-5dd5-42f4-8ab1-57cd35268cd3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-05T04:26:00Z UTC
Last seen:
2026-02-06T16:57:00Z UTC
Hits:
~1000
Detections:
Trojan-PSW.MSIL.Agensla.sb Trojan.MSIL.Inject.sb PDM:Trojan.Win32.Badex.d Trojan.MSIL.Crypt.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agensla.g Trojan-PSW.MSIL.Agensla.d Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic HEUR:Trojan-Spy.MSIL.Noon.gen HEUR:Trojan-Spy.MSIL.Agent.sb
Link:
https://opentip.kaspersky.com/3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8cdd91e8-13ff-4bfb-acc0-2bca027c86c7
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1863840
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.20 Win 32 Exe x86
Link:
https://app.malva.re/file/f1a584562bde9a0b6814c9bfd5b092b5
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-02-05 08:00:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 38 (57.89%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hmy57ox2hbgxn5w6ldhoixol3w4i7psu6iombfohlfr66433isna._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/260205-jwamlsaz6h/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
AgentTesla
Agenttesla family
Unpacked files
SH256 hash:
3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a
MD5 hash:
f1a584562bde9a0b6814c9bfd5b092b5
SHA1 hash:
1594806a529f15b39b687e75f4382a6220a52105
Link:
https://www.unpac.me/results/e5ee07cd-0ea2-496a-ab56-42d6671944b6/
SH256 hash:
48fa91de316a3b8b9b173548ff297a529e8045cfba133655cb8d7bf2517df628
MD5 hash:
54f2d8dcde429e9fa2c0cef39b6bb0e7
SHA1 hash:
1b0181a02d9f36613fdd5170d1b84a5a8358b2af
Link:
https://www.unpac.me/results/e5ee07cd-0ea2-496a-ab56-42d6671944b6/
SH256 hash:
322914f3c0ef95d6e10c742a56c4340d8c938003aa46ecb2d352f1c9510711ef
MD5 hash:
4420fdebe8c9b316c29ef615fdc61c58
SHA1 hash:
1dd16507de701ea2d26e08f6612196c7bffa3e47
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/e5ee07cd-0ea2-496a-ab56-42d6671944b6/
Parent samples :
b2c55968ebfa683dde47a788acb0cea62d164be955460d11c8fb2bfa21004311
3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a
ea05c40903621dfaf656dc4a993aef38112bfe54588f08675ad504e96b4b5a52
0821ab66a63ff2fe4d38a825b7ff3c3104a89eeb88df640d3a705b95b634bf53
330aa9b600d16462d89f74f06fa2f8b1933a0f62a3221e1043720fdbc34c57f4
SH256 hash:
fafa142f6efc057d660615b0ffc84f56500f31b1002dfe787c0876f44dd60fa9
MD5 hash:
5b00a849e9c44450fffa07c093052945
SHA1 hash:
5f469f3d73570f5b57235e60b9e176934371f39c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/e5ee07cd-0ea2-496a-ab56-42d6671944b6/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3b31dfbafa38/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Generic_Threat_9f4a80b2
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 3b31dfbafa384d76f6de58cee45dcbddb88fbe54f21cc095c75963ef737b449a

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/51770/

Comments