MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 15

Intelligence 15 IOCs YARA 8 File information Comments

SHA256 hash:	8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe
SHA3-384 hash:	6afde6758bd9427033666d0d834d4014bbf8c526dca6ed5a193ff25c4df58b518d03c209042e7a7b0a44302c3451b247
SHA1 hash:	9b6092a918809e42eb12a890076e6c58c64f3200
MD5 hash:	a87e2bd3c336cd418a2d082a3209c5aa
humanhash:	king-earth-sierra-butter
File name:	RFQ - U1058 New Materials Order B13D60.scr
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'149'368 bytes
First seen:	2025-10-06 13:50:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'754 x AgentTesla, 19'661 x Formbook, 12'252 x SnakeKeylogger)
ssdeep	12288:c1wu3d+CJOBd88257wOlg9cEqlC3nDU31rRuWaInS4ewNCpIjWpt8QtkPDODH6bH:IBJfpeOlq88wsV8Cxt7DDH6bYjoj
Threatray	1'756 similar samples on MalwareBazaar
TLSH	T178358E9E66068A89FD80DBB8CE73ABD01A54E6A71861130BF3D8667DD43F7B41D80713
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	0xb0mb3r
Tags:	AgentTesla dotnetreactor exe pure purecrypter stealer

Intelligence

File Origin

# of uploads :

# of downloads :

158

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

RFQ - U1058 New Materials Order B13D60.scr

Verdict:

Malicious activity

Analysis date:

2025-10-06 13:53:45 UTC

Tags:

evasion auto-startup stealer exfiltration smtp purecrypter ultravnc rmm-tool

Link:

https://app.any.run/tasks/3e0c3486-ca49-4a0c-ae8d-1db179f176b3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/30820/

Detection(s):

Win.Trojan.EmbeddedDotNetBinary-9940868-0

Win.Trojan.EmbeddedReversedDLL-9940922-0

Win.Trojan.Generic-10014419-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e3c936277c2bd8bc5ce359

Tags:

autorun lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Launching a process

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Launching a service

Creating a window

Stealing user critical data

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

invalid-signature keylogger masquerade net_reactor obfuscated obfuscated packed packed signed

Link:

https://www.filescan.io/uploads/68e3c939f377ab231052bde8/reports/883e9261-9cb6-4f49-abcc-2365dd86df1b/overview

Verdict:

Malicious

Labled as:

Suspicious:Spyware.Keylogger.FJ.piss

Link:

https://www.hybrid-analysis.com/sample/8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-03T11:14:00Z UTC

Last seen:

2025-10-08T11:32:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/faa61151-dfdd-4193-994a-0294b96abc7d

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.83 Win 32 Exe x86

Link:

https://app.malva.re/file/a87e2bd3c336cd418a2d082a3209c5aa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe/

Verdict:

Malicious

Threat:

VHO:Backdoor.Win32.Androm

Link:

https://tip.neiki.dev/file/8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2025-10-03 15:16:14 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rr2oqq64iasjslrx44quvujui6pgb2fyt4zqvtjlpfksyo5fk37a._file

Verdict:

malicious

Label(s):

unc_loader_078

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/251006-q5plfs1sfx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Drops startup file

Verdict:

Malicious

Tags:

Win.Trojan.EmbeddedDotNetBinary-9940868-0 External_IP_Lookup

YARA:

n/a

Link:

https://app.threat.zone/submission/a0a5c96c-9fb4-4a7c-9df8-a66638c3959e

Unpacked files

SH256 hash:

8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe

MD5 hash:

a87e2bd3c336cd418a2d082a3209c5aa

SHA1 hash:

9b6092a918809e42eb12a890076e6c58c64f3200

Link:

https://www.unpac.me/results/0ad92e50-da08-49de-b51b-9ee72ea5095f/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8c74e843dc40/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Typical_Malware_String_Transforms Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Typical_Malware_String_Transforms_RID3473 Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe 8c74e843dc4024992e37e7214ad134479e60e8b89f330acd2b79552c3ba556fe

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/30820/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample