🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
SHA3-384 hash: 70de045bb1cfd1415f8baee598edb2a3aff3d9b0560a732f4be81efb0a7caddff67694d23bc2639da38498e64e791c49
SHA1 hash: 529644d516bd9b15437a32199d5f699be20fa993
MD5 hash: cf490a06db7b31a416c9323b0554dab3
humanhash: south-seventeen-oven-twelve
File name:525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:812'032 bytes
First seen:2026-10-14 16:05:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'609 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 24576:r9KX8N8wwS46NDon/MQqa5gpwLAI8ThHkmu:r9fa38DamaCpw38f
TLSH T18405F01033A59F07E1764BF00871E33187B56E9AF921E3168FE6ACDB7939B816944783
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter ShadowOpCode
Tags:AgentTesla exe RGBLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
IT IT
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/acd0180e-cd81-4377-ba86-c11b44bc58db/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
https://temp.sh/HVmiT/RGBLoader.zip
Verdict:
Malicious activity
Analysis date:
2026-10-14 15:16:47 UTC
Tags:
rat pulsar netreactor ip-check evasion stealer agenttesla ftp exfiltration uac xworm screenconnect rmm-tool smtp ultravnc telegram snake keylogger
Link:
https://app.any.run/tasks/4e9aec16-036a-4d91-93e0-a1a6602cbb3d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/91915/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Creating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Changing a file
Stealing user critical data
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6acfa85cac4a93162696410e/reports/3de00dac-7c92-4390-8985-ed41782b5338/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-08T05:38:00Z UTC
Last seen:
2026-10-12T11:43:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/543fbb64-53be-41f3-8ffa-54153fdfe30b
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.48 Win 32 Exe x86
Link:
https://app.malva.re/file/cf490a06db7b31a416c9323b0554dab3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606/
Threat name:
Win32.Trojan.XWorm
Create hunting rule
Status:
Malicious
First seen:
2026-10-08 08:42:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kjp7o6z3fhwlaseaiook7doegkkoyrd4jqn2ufgvjyxle6xpoyda._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/261014-tjwpesvt8r/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
MD5 hash:
cf490a06db7b31a416c9323b0554dab3
SHA1 hash:
529644d516bd9b15437a32199d5f699be20fa993
Link:
https://www.unpac.me/results/71a6da6c-5eb6-453f-b3c7-08eeff96a409/
SH256 hash:
1afa952852d0d5da4bb345cd9cebdffcee5a95ba89de3956d057fbebcf7b6686
MD5 hash:
a545b9ae288a2793e5d42e9fb4de6dc6
SHA1 hash:
15d719dea2a305e0e057adbec968a4d1473832f6
Link:
https://www.unpac.me/results/71a6da6c-5eb6-453f-b3c7-08eeff96a409/
SH256 hash:
405d0dcbe8454646de26e8b2db78435803b99dccdcbcdaa1028c56c7c0c6c3ec
MD5 hash:
3e3fb75f3074003ae2ff07ecfe6fd38d
SHA1 hash:
5200f5572d3167c84842bbff7c48506011585172
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/71a6da6c-5eb6-453f-b3c7-08eeff96a409/
Parent samples :
64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2
354ed74cf297bdc4d920e3bb357fea7202856277501cbe914b1dfbe8813e841c
7a9bffbf3a920d9b72d73b73cf09f3be5dadf025055f42b5dd12761ab7c8dd34
461ba9a7d6b344421967b3c71630ec4796126b5f20bef32111447ac58e9b9202
a36cbacd3c6950de6319523835e895e8b35e32549c3a4673b3ead5215ad0d3e8
a8a6f5ad5f6bc59b64af1cca3bf0d5b6bcc8686a0dd8a8bb5cb244c2edcf3e23
4e2d3b193a9bfb9f3a369a251a1b722450fa13d8fc193d3c872ebf1062783fde
3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
e15e5d4f77fa217cf9ccf18fc0fff19e9b9e47d8c65413f2751904a14fcb8658
024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da
db4732a4b2646f6ddef351784943f58c27311215807a9ba670e9f687366e2a43
b7e0ed86028fb5faa05901945ae751051dc29ac8729b1afc62cc6efe17e20c0a
012ff5e0a2bed3ffa624958ccbc9da37a26f2fb65e3b994fec9d51b2debd2e39
0264d0104ae89e9c45fd1ebba3a20425e8f41cdc16e7deacec9d9608afcf8230
08e7a6e924c4e87cea2db6050812e058786714e788957cf0763b7d68943068c0
090fe0632814513fdece4b3c602cbcb5816f8e6b0b7a34ed73430ef6816ca227
152d4753839330b04a221d9e97093de27dcf5a4231fbd948940da26d909dd5b1
19b4de88df623cf3d95a7c3e84cdb51070360c4127322b5a929e9143d242d7f0
1af881666fdf368406d50e86d289b42853d9fc220cace6e82c5f0ee157d9bfae
297dc82be0b18123280967f224ce6ca4843b22e3b1bed07eb82cde8f78cdadef
2dc39c7548cdf4ccb0f00d94768aad3a3031c1ed29a24a59499bb6d558808c26
30a633cd9f1c25e9f76cdc78c3565462f14a444fe13f0689fe41de2163a89bd0
35bb5a32f866cf66288451eb5f04c568d58ae85dbd5b876abdb84932275215ae
3cbd641a2454d3b71544edd13f8b1940df511f3b9720555519bdc9740adb16e3
3e2aa99f1b2a0d56f34f65de5dcafafda48c23433881aba479bae67072059b56
4018da487297614f041f01b5bffe425f6a4ca43b045455b4c4ac20c04b92a61d
45d3d2858dff39d3c088b51b4b4c9452e562a85edf68f4d135ac0c69e73a0d75
4cfffae6cdd242838185f34113b65421a41ee3fcc726b8fa63c05d607164af4c
525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
5390935b00b4bb841bf005d0e43b603a78139295ea53b471230d24bdb5c423d1
5aee04c320bf3ed7046702eafa8c4e193a614981e955c98cf82bdb675edbecdd
5bf661ed804f6f8e0f65e3f8d3799873f72de9d486a5ffd71b79a62012f1fd83
676e61504a6d6ab4d90b5068bc487fb19c804b0b1ef0db814aa04fbe035195dd
68ca49836efe920aaad82f3db71bd22a9fb5bf72490f1535f1f7f2697f120a55
6ad2165eaa8bd199768ccd7dfe74a480e0602bd57c6a77501d01faebadb85e14
6bdf803d22cfdff13e317894ddbec9076aa67d85422414ee7d12a1d44c6b0fc1
6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
74615f020e5952fe66c8367ca324ce02b0ca3e98bb17327cb159181830b8e23e
785de4b2439f127566906ab1abbaa80562fdb730bc0e5c3f4d0d0c6a5af5330f
78ffe41ede09473d54e4808e703eac44cd6e79e2314c84ab4539c57ac0bf4033
7946937f5c65fe8d9f39b927c9a499917e72d88640cac1e34227758f241413c5
7f69d304597c8b10d0f5516fae40ef1db11030d68778464402d3cdaf3f586b41
86c321273fb1bae6a89344a1b8982b80d13c0774bb76a0e3cdfaeab1c4d5dd17
88f4f68676a0adb716b617a6276bc4f28bfb1fc732daca54c1582f70a124d86d
8d93bc348fc3702b7b5bd244f0a1fca04cf34903a72f18cc883e6b1333722644
9d66a32be3f221f882724bbd6aa9824232cbaef71ea46243b1c6927a9c569387
a924dc51efcc327e23837f61af68d2f793d36a36183c3cedb3987efca8382583
a995a81f862dc9994a8021fecfc55a7f8261974f50793e7bd8a73dab5e6b33a9
ab3d42f5dc68cfd3507849160e1b5f90589c49f1bc8aea1226a1dea6e2824c05
b059899fbc3393df19a209fa6c7faa35de15b2886c51572828f7f1e1d1088e87
c053108c5b25c38bc6d29569d2876396f4e744cad3d867abf4e566b3e4c3c384
c520275b04c1fbdabdac631aaf4141cd3fd8bc485aa9cfaed7c65e7ccac12c14
d5331e2c9e5d866d4515c825d6eb69de927810f8547fdc9dfb0aa545785a36b6
d86753e540f7ec56ae0e03335558af87e536c03bdd7d93511a5521ee28605341
e13ed2a8812eac03651272dfd4ac6a0431305ac845210907bea692dc59105526
e357b50c1c476180923e06378e54a7995e7966dbd633c3fe6edea1432c425833
ec340fcd3a19f99978cfd326a00108ce04d9c295ef61723dfe12c46fc8be21b9
ee173fe306d7834864d41b0d02327027a736c2f8517a6831da52b1b30e9a0d72
ef731669a765d81e3afae2c4f04cb729dd28c30a8fd60fa800ea6e10d2732011
f5b83f8a1394e025adad0de20e351321020d7d24b98ceafc9222b71c6a6f48cc
SH256 hash:
d5f9c465b8324f8d80a7f2b0dbc61e717e104c68a0c50d8558148a2887132c24
MD5 hash:
94b020433a6deac504ee8564c92e24fb
SHA1 hash:
c844a21543f1a7924688b6b29616e175d7ab560d
Detections:
triage_agenttesla_infostealer
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/71a6da6c-5eb6-453f-b3c7-08eeff96a409/
Parent samples :
12968de4ceaef7f013a3fdf9788c817ef494d391945a968d57cfd3cca4301b5d
525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91915/

Comments