MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 10 File information Comments

SHA256 hash:	8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2
SHA3-384 hash:	fb59c1110633455182f6af26a962ab9ca1e65b5ed24dfaf0a0650d5cd4ad8eea655043fcba8499d24d21ed84de65ef5f
SHA1 hash:	df9bc4b6424590d95db90d20b8fe421117fffe37
MD5 hash:	61298feca856c8f43082b91c01341955
humanhash:	william-salami-october-comet
File name:	payment advice.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	807'424 bytes
First seen:	2026-10-30 12:17:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'357 x AgentTesla, 20'862 x Formbook, 12'418 x SnakeKeylogger)
ssdeep	12288:3iIqLgBSATMDkY3j3gb8skUtXtDOV7d5y2Ruhut+hez8cm/dNQqmF8WxhQo:S0BSATMocj+ULRuMkhOjiaqu8W
TLSH	T161059D142126C762D8657BF3CE32D8F117732CA6D2A2D2DB4EE13CEA7972B606905713
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	James_inthe_box
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

277

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/bad34ace-5426-41d0-bd20-6e70a575ba3f/

Malware family:

agenttesla

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-30 12:19:25 UTC

Tags:

rgbloader loader ip-check evasion stealer exfiltration agenttesla ftp

Link:

https://app.any.run/tasks/2cb784ad-b083-44b7-a5f3-bb9ab17f06a8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/96216/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.3690.29960.12582.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae48acfb121dd519dcee695

Tags:

virus micro lien msil

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/6ae48ac9869b93e00becbf91/reports/2cf15b9e-5808-43a3-9fa0-eeeb328b5f51/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-29T19:47:00Z UTC

Last seen:

2026-11-01T06:07:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2/results?tab=lookup

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1b68d570-0a9c-4c5e-a3f8-a57105c51522

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1995354

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Suricata IDS alerts for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.46 Win 32 Exe x86

Link:

https://app.malva.re/file/61298feca856c8f43082b91c01341955

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2/

Threat name:

Win32.Trojan.InfostealerTesla

Status:

Malicious

First seen:

2026-10-30 01:44:55 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 22 (77.27%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rkgockntxdu5ttjh7wolpe7q4cdiwz2xtvmv6b3of76idu627tra._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/261030-pf5qpsbz61/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

Malware Family:

n/a

Verdict:

Malicious

Tags:

injector stealer evasion rat

YARA:

n/a

Link:

https://app.threat.zone/submission/17e38c7b-ef29-4103-9737-fec35816e027

Unpacked files

SH256 hash:

8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2

MD5 hash:

61298feca856c8f43082b91c01341955

SHA1 hash:

df9bc4b6424590d95db90d20b8fe421117fffe37

Link:

https://www.unpac.me/results/373551e8-f5cf-41d4-9e1c-a65acce8f6a2/

SH256 hash:

f613bcf6eebf22d1f7a80092ba723757aa68f9c1d67a640fe575057a22b17bd2

MD5 hash:

8e3cc3cd26a9d0346bff772a195f94c2

SHA1 hash:

7953eef655fbd6ff426164ba7aea665937f29e9c

Link:

https://www.unpac.me/results/373551e8-f5cf-41d4-9e1c-a65acce8f6a2/

SH256 hash:

b9ef8fef5b455817a626806044ae6567cb1f7bafaa7d17a7724a02a25f90d2d2

MD5 hash:

86ce51cb209a5dcd67d0b47572b4e9e2

SHA1 hash:

b6ea8196e73da138d403048b659127ffd5c0c73f

Link:

https://www.unpac.me/results/373551e8-f5cf-41d4-9e1c-a65acce8f6a2/

SH256 hash:

89c1a2c27470e898513e95d6175c382cd5a33fd6a509cde700b213214ecf0b80

MD5 hash:

9a3d0e61430550fc5f788c7cef6c1644

SHA1 hash:

c5dfb45b76144ce20870bbdd5defb0a51989e0bb

Detections:

triage_agenttesla_infostealer

win_agent_tesla_g2

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

MALWARE_Win_AgentTeslaV2

Link:

https://www.unpac.me/results/373551e8-f5cf-41d4-9e1c-a65acce8f6a2/

Parent samples :

89c1a2c27470e898513e95d6175c382cd5a33fd6a509cde700b213214ecf0b80
86f0d9e69171fdf591af6df81030e4debb2710a2b8e59807862f50f27d79531b
8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2
96a3452b35774892f536e38503827988eb8c7d6ee0cfb9d0d25f4beddfa182ff
e8329eb33b87602a41bcc3bb9ce920fcc66a9e61cf9679b0097bad113b180ff0
149b336d39c214271aa59d4840f43f53b3d9df1394fed57536a8553be2d0f1bb
d55e0bf350957c3d6e1a640a38b033ad0d2b48e27fd9b3f6c8bb829cf1b0e4a6
071e3e45090fd134fad750dff5cfbf2c873ed5c3d1c6826d61bb5ab0bbab1de3
0f11c24041a20cbec51c94030ef9e0fcfc2c97c8e759b11d40e9fca171193993
a767f88ed6faea47e46ca08c055b30c4af53588aa90eb947652937742416a183
3d640bf4e2ab2ed2ebb277037b76d21ca31eb7c036f4001c77d0302b84bab241

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.87

Link:

https://yomi.yoroi.company/submissions/8a8ce129b3b8e9d9cd27fd9cb793f0e0868b67579d595f076e2ffc81d3dafce2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	DotNet_RGB_Embedded_AssemblyLoader_Hunt Create hunting rule
Author:	ShadowOpCode
Description:	Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Derialock (pe, etat extrait)

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/96216/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample