MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0
SHA3-384 hash: d9151a57c8df1764323992b15a3623b3dfcf0e2ccaef75db2a2ec0b25f2952391569e56e82d4342345328ca9e6d0aee8
SHA1 hash: e54344846679c4eb74c0edece3061ed73baf4575
MD5 hash: 8c9c8e430e1eef28ed30c860b0d5458b
humanhash: jupiter-eleven-five-oven
File name:6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'000'448 bytes
First seen:2026-06-08 09:19:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'067 x AgentTesla, 20'019 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 24576:VE30nNrmH5uL3rSqGKukPx/TvRUlfbVbVzIIkr1:VJSHgL3OqGgRJUljVbVzMp
Threatray 99 similar samples on MalwareBazaar
TLSH T179251294269ED306D0B64BF02871D1B813746EAAE430C70B9FC93CDFB9B57A05845B97
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 68e48c98b6b6b4c8 (5 x AgentTesla, 2 x a310Logger, 2 x Expiro)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/427932f3-6f1f-465f-8fcf-d5a96829e0c5/
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69720/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2689763e9eff6a6b68b889
Tags:
redline virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 packed vbnet
Link:
https://www.filescan.io/uploads/6a2689271f652d68656db3ab/reports/f21ad84c-0859-44e3-9330-a4fccefe0e71/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-07T01:04:00Z UTC
Last seen:
2026-06-09T20:25:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/78a85e5a-f767-429f-83fa-1a121f3740c4
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0/
Threat name:
Win32.Trojan.RedlineStealer
Create hunting rule
Status:
Malicious
First seen:
2026-05-07 03:58:08 UTC
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=niw76v46tyozyj2mbt5yry2lqfjyt7zeftl6axnqrow73higthaa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37
AgentTesla
4a2b467d823861199497178aa9c39088b91bcb3fcb3c164238ffa039fdc0a1a0
AgentTesla
500cd979076c01f3873bd08de8f09163f74eb25a462ea66037b92a0665524012
AgentTesla
5300e3303b8d3213380216de0de7f3321cac74a6a8e5c7f2d506d3a5db92b42d
AgentTesla
a6455dea59980cdbab8c1a1002a84b1db5531e646a292a0c6489e7818bae445c
AgentTesla
c1809985bc96ceb090d1627981130698f934d033f8c45b49d8f07326ff11ab73
AgentTesla
error
AgentTesla
+ 89 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260608-lamq6aby8t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0
MD5 hash:
8c9c8e430e1eef28ed30c860b0d5458b
SHA1 hash:
e54344846679c4eb74c0edece3061ed73baf4575
Link:
https://www.unpac.me/results/77651af1-115b-4e5f-8fc2-811a897b98da/
SH256 hash:
2cbe0104d0a55f21c2f0e895a50df2ffdbdebfe2e020c7b5dead6aaeb233467e
MD5 hash:
6e709eef0402edad04464e90fd7b700d
SHA1 hash:
7b78f8a790bcbb4febf73b1dc77abbb4de9ab099
Detections:
win_agent_tesla_g2
Create hunting rule
triage_agenttesla_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/77651af1-115b-4e5f-8fc2-811a897b98da/
Parent samples :
a515fd4ef2d7b5c1d60af04da2e2138036f493ce5d02d1491354560b718f80ce
95f214d4e4b557548f2077ed9ab2f260471326b442a45824db16ec7c58fe0900
8a3fe2533d9c2036dd92b2b437b8d1ca237308d4383cdfb4cf13eadd9012060a
6fc591dec9831bfce04458d407a74f24728019a03ac61a8aa0cbc64791c68d63
ad131f58df2bb784cc7182a2afb12c7dbc9c139bcd881d913eb7776e9b399c02
2cbe0104d0a55f21c2f0e895a50df2ffdbdebfe2e020c7b5dead6aaeb233467e
a23faad998ccfd975f0123b836dd65c158f931f1ea3c01e5415c82a148b08f89
5300e3303b8d3213380216de0de7f3321cac74a6a8e5c7f2d506d3a5db92b42d
c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c
3962e783a7d66e1fcc1a26328c1cb3f9e1af50a1005a447449999d5f5b8bd880
ce3562ba09381cf9931edac0983a7f732b5d1007ea878416fed7fb3a9958cb8d
6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0
31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37
SH256 hash:
caebf12cf2229d84b4fabdf412326d127d2d9fef20e6ec54198ace170e5110e7
MD5 hash:
0d7d14bd5d98367a66ae34fdaefefab7
SHA1 hash:
c6e7e12d4f2ff0a7faaa92d677b88633bcd8ebcb
Link:
https://www.unpac.me/results/77651af1-115b-4e5f-8fc2-811a897b98da/
SH256 hash:
7913238c6361027fe233b3e6b67140950c7d1b1ee1ade539060443a9a35c0531
MD5 hash:
c5d23e049f0583e4eb37f1fc7e02887f
SHA1 hash:
c737d09fbe2c8cd66206b4020171846fddef5be4
Link:
https://www.unpac.me/results/77651af1-115b-4e5f-8fc2-811a897b98da/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6a2dff579e9e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69720/

Comments