MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 20

Intelligence 20 IOCs YARA 22 File information Comments

SHA256 hash:	8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea
SHA3-384 hash:	edec1a55d4b0236ac48138c87bca3adc51ba11ce358aaf40466cc4f43fbe068946c53ecdf3d30deb279f6ab00da659aa
SHA1 hash:	34e2b8df5fe1ca4ab3d6c1c60ff5b4679e0626b3
MD5 hash:	8a76f822646c496045444c737d43a968
humanhash:	hot-uranus-lemon-salami
File name:	PI for #PO22103.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	179'712 bytes
First seen:	2025-04-30 13:10:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	3072:83rN1mRbutuKNX+8Krl7RZtSzXZrn8y5TVASy9fmkN/9Vb21VcfhQPivov1g:yCIuK4ZR7RXSzZrnH5rmf9J3b2PIhQPH
Threatray	3'419 similar samples on MalwareBazaar
TLSH	T1CF04AD9C725032DFC867C572DEA82DA8FB65787A831B8203D42715ADEA4C887DF544F2
TrID	28.5% (.EXE) Win64 Executable (generic) (10522/11/4) 17.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.2% (.EXE) Win32 Executable (generic) (4504/4/1) 5.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
Reporter	James_inthe_box
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

525

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

PIforPO22103.exe

Verdict:

Malicious activity

Analysis date:

2025-04-30 13:14:35 UTC

Tags:

stealer evasion exfiltration agenttesla ftp

Link:

https://app.any.run/tasks/d5f3d0da-96d0-4649-8184-a1cbd9f0f503

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/5229/

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6812221ccc5fb3600cc53352

Tags:

jigsaw packed virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Creating a window

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

confuser confuserex obfuscated obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/6812216b212716475fb15d2e/reports/42edd091-d02a-4f40-ad74-950aa429ce7d/overview

Verdict:

Malicious

Labled as:

Ransom.Jigsaw.Generic

Link:

https://www.hybrid-analysis.com/sample/8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4039dbc0-34bb-4604-a3a0-cb613b00e444

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1678141

Signature

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

PE file contains section with special chars

PE file has nameless sections

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-04-30 04:44:27 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qby2hajphufzjek4au6kkxswwelfjwdggtw3nzh7cgnbmorjetva._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2721334b6e632df9c325337f43656c1e2ed4afb5e0e1e1b74a55055346d3200e

AgentTesla

6f3ee676d229cbe5bfa2d69a63513b3dc194f45f17f97e27f7c8fafb85e8cfdb

AgentTesla

9e19f6b4011cfb241e826abc5e52b9e2c5b99966a661ab548b90691b06cb3900

AgentTesla

aba4d6ba306deaf02c3122060facf7e11d19da806321ac993c42461d4e9edcd7

AgentTesla

+ 3'409 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250430-qey27sy1gv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

AgentTesla

Agenttesla family

Verdict:

Suspicious

Tags:

external_ip_lookup

YARA:

n/a

Link:

https://app.threat.zone/submission/97ca0e4a-11f8-43e9-b715-1f39da55f4bb

Unpacked files

SH256 hash:

8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea

MD5 hash:

8a76f822646c496045444c737d43a968

SHA1 hash:

34e2b8df5fe1ca4ab3d6c1c60ff5b4679e0626b3

Link:

https://www.unpac.me/results/f5838fad-297e-47b7-9683-8e35bfdee9bb/

SH256 hash:

3caebbf763ff72ab0734f32192a9bcfee64d76b8aa87f96076d53b774fe832fd

MD5 hash:

1d2c40012b66af1c2619c73f3ff1a82b

SHA1 hash:

086f26884187faaaed8b9e1ff36912fd1d88e1cf

Link:

https://www.unpac.me/results/f5838fad-297e-47b7-9683-8e35bfdee9bb/

SH256 hash:

a1870851711ec6ba57c5f9d42c611d602200bf7c8b668a0e67b6128dbb376fc5

MD5 hash:

0bb803783ca80b02779cb1bfe9213643

SHA1 hash:

4c4310a75c93747017df0c4b5117c4a2b3a92bce

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

INDICATOR_EXE_Packed_ConfuserEx

Link:

https://www.unpac.me/results/f5838fad-297e-47b7-9683-8e35bfdee9bb/

Parent samples :

477b2790123de7d0c9486a1942087c05ef26bb45eea5160cd0f5411cb7797458
9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9
fc0a1ad679e97793a6fdaba06b70d49018693deeb86ae54a0a450343f511cbf0
8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea
1f17ccbd43f941b1a79412d24ad8e60f33a916d3fe73c257d65d7954313f8f5e
d56f47c995f2b7727435d6f3f4c840aa01697939fe1c228e2bbbcfa196cf2904
f7095affa7e61a334e6abdb3655ba9a801d638fc7322c649dacdd48051146f5b
4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07

SH256 hash:

bda6b3db8466b40c72979dd92126f2ff34b81d9258ce1c6d7a69aa6572d2f50b

MD5 hash:

254d3d4babfc0b4e6a0443e1e10a516d

SHA1 hash:

74544f48ec59ef064a03ae3d669253856f6a3806

Link:

https://www.unpac.me/results/f5838fad-297e-47b7-9683-8e35bfdee9bb/

SH256 hash:

9a28701308f1ed79d5233a7aa1122b5ea0fcfbf5adf6dc09ecad403d642c6cc0

MD5 hash:

fb7175d816fd15d6d07ef9c974afb71a

SHA1 hash:

d85495a4ea9a1d5bff6f3346e274b866ab680987

Detections:

win_agent_tesla_g2

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

MALWARE_Win_AgentTeslaV2

Link:

https://www.unpac.me/results/f5838fad-297e-47b7-9683-8e35bfdee9bb/

Parent samples :

8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea
1f17ccbd43f941b1a79412d24ad8e60f33a916d3fe73c257d65d7954313f8f5e
fd0049f3bb1393c8192f8053301b8472a18f1bbedb4011655d756fbf3a0b3aa5
d56f47c995f2b7727435d6f3f4c840aa01697939fe1c228e2bbbcfa196cf2904

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8071a3812f3d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV2 Create hunting rule
Author:	ditekshen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	MALWARE_Win_AgentTeslaV2 Create hunting rule
Author:	ditekSHen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Generic_Threat_779cf969 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe 8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/5229/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample