MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 21


Intelligence 21 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849
SHA3-384 hash: 35cf4bd4a42e33ff76be29bbce88084c7ced807b618f5da29bdc6c04eeb65d83776c507a9f19edfb9b7ddd965c4f2f1b
SHA1 hash: 48fe4265386abf1fc72a0051f06dd001996a3ac8
MD5 hash: 882617e91c7ca169be34b52684dcb4e2
humanhash: speaker-uniform-hawaii-crazy
File name:Order BC 12892- 12831 - 13426 PDF.bat.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'157'120 bytes
First seen:2026-05-27 12:12:59 UTC
Last seen:2026-06-08 08:43:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'081 x AgentTesla, 20'056 x Formbook, 12'353 x SnakeKeylogger)
ssdeep 24576:Js3qPyUi7oNFLFanYJmdQCZOtYX0IS9AEFT0D:wqyR7oNFLF8YiOtlIS93FQ
TLSH T1AE3501142219CD42D4AA4BB81A65E3B417B84E9DE826D3079FC1BFEBBC3A7705D04793
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
15
# of downloads :
186
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/efb9672f-299e-4aba-8897-c55b2f733f9d/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
_6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849.exe
Verdict:
Malicious activity
Analysis date:
2026-05-27 12:19:10 UTC
Tags:
netreactor auto-reg ip-check evasion stealer agenttesla amsi-bypass
Link:
https://app.any.run/tasks/d3ad8e49-1200-4ea5-9470-b6c4ed424817

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68161/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a16dfed5b1db29f5a486a8c
Tags:
micro shell lien sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Launching a service
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6a16dfe646e44aecc0bf6b43/reports/dd50bccb-321e-4542-b5a0-c6b0a64e0bc5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-27T06:12:00Z UTC
Last seen:
2026-05-29T03:37:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agent.sb Trojan-PSW.MSIL.Agensla.g Trojan-Dropper.Win32.Injector.sb HEUR:Trojan-PSW.MSIL.Agensla.gen Trojan.MSIL.Crypt.sb Trojan-PSW.MSIL.Agensla.sb HEUR:Trojan-Spy.MSIL.Agent.sb Backdoor.Win32.Androm.sb Trojan.Win32.Vimditator.sb Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan-PSW.Win32.Stealer.sb
Link:
https://opentip.kaspersky.com/6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cada05a8-d5d4-4531-bd2a-cea1b100c1c6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849
Threat name:
Win32.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2026-05-27 09:06:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n5x76mgkrinej3q56hlnvsjtcozhvoqjjx7wj5s3gbgul4fplbeq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260527-pdy55sft2v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849
MD5 hash:
882617e91c7ca169be34b52684dcb4e2
SHA1 hash:
48fe4265386abf1fc72a0051f06dd001996a3ac8
Link:
https://www.unpac.me/results/591edfbe-20c3-491b-a2cc-9e6e017f5a9f/
SH256 hash:
3ce245aea5d80d36d3fd84ae9a9d0aed411599016a24d178473e0c48a70715d3
MD5 hash:
cafb7cb08f883bfc2ef7a68eb754488b
SHA1 hash:
4bfb06256c8ffc8a3920ae32206b42edcbacfe5b
Detections:
win_agent_tesla_g2
Create hunting rule
triage_agenttesla_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/591edfbe-20c3-491b-a2cc-9e6e017f5a9f/
Parent samples :
6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849
fc4ba40128ee5df9caaa25bafe1a3d6619f208b2bd206f564267298a0294328f
57d4c1525bc46d8df0acc327a131bc149c396e6200bb082fd4b0f1a443b0f8a9
7dd595347aea3817cde5da19e3a6b76adf2f0baef0ecbd67ff3d80be1d5930a4
SH256 hash:
6f49c5a71bdaaaa0e09f636e6cd8ab7a7859d9dc2fec5ca1dea3e7cf1212832e
MD5 hash:
f32483f216931abe2c0720f42ca1ee65
SHA1 hash:
531738dd92dfee870f20f93c883c1e1b72618575
Link:
https://www.unpac.me/results/591edfbe-20c3-491b-a2cc-9e6e017f5a9f/
SH256 hash:
9f7dd573f72ae05a0e1c359106e684b1ca1d49cdc843575f3fded626dedd7441
MD5 hash:
bcf98dfa54a53cb0201aae64af626d02
SHA1 hash:
588e536ebdfe1b1f2fe4d467f9df66da9a038e17
Link:
https://www.unpac.me/results/591edfbe-20c3-491b-a2cc-9e6e017f5a9f/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6f6fff30ca8a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/68161/

Comments