MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580
SHA3-384 hash: b48be09129c4033dac0c26b8ef48aead625cd8eb0e95c8f3297b832c7d57b21c505dfafc39ab065b7fc9563c0c9f07d2
SHA1 hash: fdbebac6609757cb85d2d5d5e6924eaf918c4fae
MD5 hash: ab4022da25c6eb474fbdec7873cb47db
humanhash: item-illinois-quebec-fish
File name:3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'133'568 bytes
First seen:2025-11-06 11:09:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1895460fffad9475fda0c84755ecfee1 (347 x Formbook, 103 x AgentTesla, 58 x a310Logger)
ssdeep 24576:m5EmXFtKaL4/oFe5T9yyXYfP1ijXdaOUy+IG7s7Xr:mPVt/LZeJbInQRaOmzs
TLSH T15E35AE027391D062FFAB91334B5AF6115BBC79260123E62F13981D7ABE701B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580
Verdict:
Malicious activity
Analysis date:
2025-11-06 18:53:04 UTC
Tags:
stealer auto-reg ultravnc rmm-tool evasion agenttesla
Link:
https://app.any.run/tasks/48b145af-14f8-4d1d-a534-983cc5b9aaa2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/36051/
Detection(s):
SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c82395a5ed7864e237a42
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Launching a service
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Trojan.BAT.Agent.gen
Link:
https://www.hybrid-analysis.com/sample/3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-21T22:49:00Z UTC
Last seen:
2025-11-07T17:19:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bbdec3c9-64e6-4406-add7-e83688605595
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/ab4022da25c6eb474fbdec7873cb47db
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-10-22 01:59:10 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
30 of 37 (81.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=huhrvf2gsukbb5emhbawwckrkbglm5cvlprxfjapwjl43cjniwaa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/251106-m9dszaal5z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
External_IP_Lookup
YARA:
n/a
Link:
https://app.threat.zone/submission/a820ef29-38a4-4cda-9014-dd0d621921ab
Unpacked files
SH256 hash:
3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580
MD5 hash:
ab4022da25c6eb474fbdec7873cb47db
SHA1 hash:
fdbebac6609757cb85d2d5d5e6924eaf918c4fae
Link:
https://www.unpac.me/results/83cbeaae-3917-44ac-ab80-dbd0a0705792/
SH256 hash:
58c59db211f470aeebb8513b07d4cb39e17273441a989e74aaf6a4f82ea8f817
MD5 hash:
3b237a5f20a41a7e7f362b0a6a819de4
SHA1 hash:
8b17aafd052970edfa0bb9d6b457e3a956f4b86e
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Agenttesla_type2
Create hunting rule
Link:
https://www.unpac.me/results/83cbeaae-3917-44ac-ab80-dbd0a0705792/
Parent samples :
1ac7e58bde311b270cf53ca82e2b5859aa79c53665ea7607873228528d753d8d
1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1
2ce30c206c8b8fd863e98c63fa1c75b31a3c3018eab127c5496708cf8c95eb22
1a7b2ef159ce7661ef4f3ee824242615c90c04ae80cd9ae3bf74a093891abb0d
3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3d0f1a974695/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d0f1a9746951410f48c38416b0951504cb674555be372a40fb257cd892d4580

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:Windows_Generic_Threat_9f4a80b2
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/36051/

Comments