MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 10 File information Comments

SHA256 hash:	3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241
SHA3-384 hash:	9b6a6b92c9ff616419ce1fd3bc56fe72a09c1092ab6642253191039b74b8d3fe017019ba40df9e230d8751e1003a2c27
SHA1 hash:	8fda0f8ed535a0ed205d06a2b8d8d5d2ea238dc4
MD5 hash:	69fd7e35e40f8dbb3e976caad9eac957
humanhash:	beer-video-berlin-kilo
File name:	3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	802'304 bytes
First seen:	2026-11-09 08:55:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'350 x AgentTesla, 20'845 x Formbook, 12'417 x SnakeKeylogger)
ssdeep	12288:YRSATMmmKWnLDo/MkXc2x9oyhMOsiUkckW1Ry+R1VjRiRbtHd6j84397:ASATMm7WnPwMZ27oCDU9f7d1VjgbL
TLSH	T16705F12975275417D9B26EF00C71E4B09B361DAA6139E1D98FC62CABB4F7B10BE02317
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	71f8febeab80c071 (4 x Formbook, 3 x PureLogsStealer, 1 x AgentTesla)
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/de2ab12e-452d-45cd-b5aa-06c839622a92/

Malware family:

agenttesla

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-09 22:52:16 UTC

Tags:

rgbloader loader ip-check ftp stealer agenttesla exfiltration

Link:

https://app.any.run/tasks/ab97041a-ebe6-45df-a711-f1e5de64aebc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/98658/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1c9861492c978625a7ba9

Tags:

injection virus lien msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Creating synchronization primitives

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Launching a service

Changing a file

Stealing user critical data

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-26T00:28:00Z UTC

Last seen:

2026-11-04T23:36:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241/results?tab=lookup

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2001719

Behaviour

Behavior Graph:

n/a

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.39 Win 32 Exe x86

Link:

https://app.malva.re/file/69fd7e35e40f8dbb3e976caad9eac957

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241/

Threat name:

ByteCode-MSIL.Trojan.SnakeKeylogger

Status:

Malicious

First seen:

2026-10-26 03:34:57 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 36 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hvsax5hcvmxnf25so4bxw5wsdsrr5n6ag32aahdx2aycxbf2wjaq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/261109-kv58kaytgs/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

Malware Family:

n/a

Verdict:

Malicious

Tags:

injector stealer evasion rat

YARA:

ConventionEngine_Term_Desktop ConventionEngine_Term_Users ConventionEngine_Keyword_Client

Link:

https://app.threat.zone/submission/c55f261a-6292-4459-a9e1-329309250864

Malware Family:

msil

Malicious:

True

Tags:

dotnet polymorphic peexe

Link:

https://intel.virussign.com/intelligence/file/3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241

Unpacked files

SH256 hash:

3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241

MD5 hash:

69fd7e35e40f8dbb3e976caad9eac957

SHA1 hash:

8fda0f8ed535a0ed205d06a2b8d8d5d2ea238dc4

Link:

https://www.unpac.me/results/424daa28-5ada-4527-9038-0c65eb1a7945/

SH256 hash:

faa13b7d23c87ee50febcd5e60255e39d495fae37921be72b9e5969ca951da26

MD5 hash:

e47218308dc71becf2eb84b2ac1e46f4

SHA1 hash:

06a3b7d2c8d3bd315ff885aced0511eebed23265

Link:

https://www.unpac.me/results/424daa28-5ada-4527-9038-0c65eb1a7945/

SH256 hash:

b9ef8fef5b455817a626806044ae6567cb1f7bafaa7d17a7724a02a25f90d2d2

MD5 hash:

86ce51cb209a5dcd67d0b47572b4e9e2

SHA1 hash:

b6ea8196e73da138d403048b659127ffd5c0c73f

Link:

https://www.unpac.me/results/424daa28-5ada-4527-9038-0c65eb1a7945/

SH256 hash:

89c1a2c27470e898513e95d6175c382cd5a33fd6a509cde700b213214ecf0b80

MD5 hash:

9a3d0e61430550fc5f788c7cef6c1644

SHA1 hash:

c5dfb45b76144ce20870bbdd5defb0a51989e0bb

Detections:

triage_agenttesla_infostealer

win_agent_tesla_g2

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

MALWARE_Win_AgentTeslaV2

Link:

https://www.unpac.me/results/424daa28-5ada-4527-9038-0c65eb1a7945/

Parent samples :

89c1a2c27470e898513e95d6175c382cd5a33fd6a509cde700b213214ecf0b80
86f0d9e69171fdf591af6df81030e4debb2710a2b8e59807862f50f27d79531b
8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2
96a3452b35774892f536e38503827988eb8c7d6ee0cfb9d0d25f4beddfa182ff
e8329eb33b87602a41bcc3bb9ce920fcc66a9e61cf9679b0097bad113b180ff0
149b336d39c214271aa59d4840f43f53b3d9df1394fed57536a8553be2d0f1bb
d55e0bf350957c3d6e1a640a38b033ad0d2b48e27fd9b3f6c8bb829cf1b0e4a6
071e3e45090fd134fad750dff5cfbf2c873ed5c3d1c6826d61bb5ab0bbab1de3
0f11c24041a20cbec51c94030ef9e0fcfc2c97c8e759b11d40e9fca171193993
a767f88ed6faea47e46ca08c055b30c4af53588aa90eb947652937742416a183
3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DotNet_RGB_Embedded_AssemblyLoader_Hunt Create hunting rule
Author:	ShadowOpCode
Description:	Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/98658/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample