🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5
SHA3-384 hash: d15f133155aa2e068ef22c40623ccb87cf2016c417a92ea63be975d42dae0f18d77a6db131cae86625befe490bfed5c3
SHA1 hash: 542a220e823ea486dcd0ab63f41c657b9dbfde5b
MD5 hash: 248af4fda697661d9451ab6123b3463c
humanhash: harry-winner-white-oscar
File name:Urgent_Payment_Request_INV-2026-0916.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'103'872 bytes
First seen:2026-09-22 06:44:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'242 x AgentTesla, 20'499 x Formbook, 12'374 x SnakeKeylogger)
ssdeep 24576:F2S7Rhhg5DqoQxU49MFwqM1oUzPyAbx259Yy5OCRmVBNW2N:F2Ahe5vAMlM1hKAV2Sy5w/NJ
TLSH T160350100225ACD07E5A64FF40D30E7B406B95E99A911C3138FFBBDEBB53EB553809282
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/2663caf4-7715-4022-ba03-03f9ae2bba5e/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-22 07:26:04 UTC
Tags:
auto-reg ip-check evasion stealer netreactor exfiltration agenttesla ftp
Link:
https://app.any.run/tasks/dfcad794-2f0f-425c-8bbf-2cb928b55594

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/88224/
Detection(s):
SecuriteInfo.com.Trojan.Siggen34.14609.4696.27095.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Launching a service
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dropper formbook masquerade obfuscated packed
Link:
https://www.filescan.io/uploads/6ab22402f686bbaa07647d08/reports/2b15a4c4-f047-40cc-804a-b3b498e34259/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9f54f13a-1d5b-4b26-96c0-4f149fe4c3a1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1975978
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: Suspicious Double Extension File Execution
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1975978 Sample: Urgent_Payment_Request_INV-... Startdate: 22/09/2026 Architecture: WINDOWS Score: 100 40 mr-b01.tm-azurefd.net 2->40 42 ip-api.com 2->42 44 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->44 60 Suricata IDS alerts for network traffic 2->60 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 17 other signatures 2->66 8 Urgent_Payment_Request_INV-2026-0916.pdf.exe 1 6 2->8         started        12 powershell.exe 11 2->12         started        14 powershell.exe 2->14         started        signatures3 process4 file5 34 C:\Users\user\AppData\Roaming\kp.exe, PE32 8->34 dropped 36 Urgent_Payment_Req...26-0916.pdf.exe.log, ASCII 8->36 dropped 68 Creates autostart registry keys with suspicious values (likely registry only malware) 8->68 70 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->70 72 Creates an autostart registry key pointing to binary in C:\Windows 8->72 74 Adds a directory exclusion to Windows Defender 8->74 16 MSBuild.exe 15 2 8->16         started        20 MSBuild.exe 8->20         started        22 powershell.exe 23 8->22         started        24 MSBuild.exe 8->24         started        76 Found suspicious powershell code related to unpacking or dynamic code loading 12->76 26 conhost.exe 12->26         started        28 conhost.exe 14->28         started        signatures6 process7 dnsIp8 38 ip-api.com 208.95.112.1, 49721, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 16->38 46 Tries to steal Mail credentials (via file / registry access) 16->46 48 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 16->48 50 Tries to harvest and steal browser information (history, passwords, etc) 16->50 52 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 20->52 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->54 56 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 20->56 58 Loading BitLocker PowerShell Module 22->58 30 WmiPrvSE.exe 22->30         started        32 conhost.exe 22->32         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.29 Win 32 Exe x86
Link:
https://app.malva.re/file/248af4fda697661d9451ab6123b3463c
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-09-16 09:43:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oz5mvy2bz2dxombomhqkoull6srnwwruyktthnonjji3l5wsblsq._file
Verdict:
malicious
Label(s):
AgentTesla
Create hunting rule
Link:
https://reports.threatray.com/b98a5328-648d-4007-bf3f-8c016eadbbb0
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260922-hh83ksac97/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5
MD5 hash:
248af4fda697661d9451ab6123b3463c
SHA1 hash:
542a220e823ea486dcd0ab63f41c657b9dbfde5b
Link:
https://www.unpac.me/results/c9538b1b-da6c-4f72-80dd-5c422eebd52e/
SH256 hash:
27f337919a8f19afdc09e50e71b059533901c5a525371718944bee68fa68325d
MD5 hash:
300efd3a3bc3dd8554435522252b8632
SHA1 hash:
43fe524c5e2d929d8b745b7e8fdb2ebf4009ca52
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c9538b1b-da6c-4f72-80dd-5c422eebd52e/
SH256 hash:
e2ea238b69843146f96d295b44370f5dd882320a65c025f92291757e684d4fb6
MD5 hash:
45ecb5a375b76e9b31cbc7dc1aaab66b
SHA1 hash:
6dc608054f474d7c339f96b7662cbcc3381531be
Detections:
triage_agenttesla_infostealer
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/c9538b1b-da6c-4f72-80dd-5c422eebd52e/
Parent samples :
75da0bf66f46e65566f18b468fe3b747b371fb854bf2fedc0b6c77ad3984dafa
cd779076639126e20c3a7f2db656f376977953493fa33cc1ac232c4631f19810
767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5
SH256 hash:
c4ff80fbb1b2133b1f76bb68d29f776437a5b168ab12da8876aa25f16888a391
MD5 hash:
2df86e0c3383c2a1ba077bd3eac73794
SHA1 hash:
f4b103d7cd6d89ec06da3770e66382f1cd854402
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/c9538b1b-da6c-4f72-80dd-5c422eebd52e/
Parent samples :
4a9a4282a7c02191cfdcc480e7af5fc5619be8902cae717cda731dd32cf493c5
1d75132e5ab94b7c75d14101f440af68e9fd46ff81286b280955f5e462148417
3f29b402fc1126ee40b8c2e7058f67a49fd3518d3d2e43b7dabf5da4e9f89589
b26c37434671d62ad1e1396db886d0419bf778d4ca5b3b54cf46319c40c277e0
c4e4375701cb85ee71bf3182cdabd6ab27ef71c9cc635469f76c85da29f4e102
767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5
e5530ac3388f55153f5ae4ebf01abdfbcb1a2e76ffac7e8ca1ebbcac3364fb3a
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/767acae341ce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/767acae341ce8777302e61e0a7516bf4a2db5a34c2a733b5cd4a51b5f6d20ae5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/88224/

Comments