MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 18

Intelligence 18 IOCs YARA 24 File information Comments

SHA256 hash:	8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99
SHA3-384 hash:	59ed1e0d927b90d28599017eba66813ce8b5dcbe408495a263db38ed85013f9550b2d807cc68fe71ab6d8bdf5defdc3a
SHA1 hash:	725a8c839c8e78f5f611fe4532d4df45f117c530
MD5 hash:	5eaf0abd7ada39f208121d7d3bd31969
humanhash:	single-montana-kilo-crazy
File name:	EUROOOOO.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	335'360 bytes
First seen:	2025-08-09 12:35:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	6144:vjpv21rpLZ8V8ZuqhmR23bX9x7uueBKrw4HrDo+jn1YC:vV+HeT8X9x7SHILj
Threatray	3'934 similar samples on MalwareBazaar
TLSH	T1A264234E33BCC47CD229353C84EA61C60212C58778869F5A68E91BE54C673DB354FAFA
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	zhuzhu0009
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

https://files.catbox.moe/xz6y5x.zip

Verdict:

Malicious activity

Analysis date:

2025-08-08 02:16:19 UTC

Tags:

arch-exec stealer evasion ultravnc rmm-tool agenttesla ftp exfiltration

Link:

https://app.any.run/tasks/96472329-817f-44b8-a675-3e1d5253ccce

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/19888/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689740aa1e8a59ee04e7f921

Tags:

micro

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Launching a service

Changing a file

Creating a window

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 crypto_obfuscator crypto_obfuscator_for_net obfuscated obfuscated packed packed

Link:

https://www.filescan.io/uploads/689740a99ef4d2ff7cf3eeae/reports/8c03a99f-14f8-4c8f-9280-d743be00d4a0/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/c6a66dce-542b-4cea-aeea-0d55b332d542

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable PE (Portable Executable) SOS: 0.99 Win 32 Exe x86

Link:

https://app.malva.re/file/5eaf0abd7ada39f208121d7d3bd31969

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99/

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99

Threat name:

Win32.Spyware.Negasteal

Status:

Suspicious

First seen:

2025-08-07 09:31:50 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

27 of 36 (75.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rxc44gybnpnoxr6xpiqmzt4bljeyidrdtqzrgljvkbgqhrpwvsmq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

7abb1ed70d48d5cb6ca3f7830fa49c076a5e9c1b25cfde49bcb5d0137a9349df

AgentTesla

9d33d6e6f5c8d96980bb2774d72d8f2a8dfe3a29674b69f125ffb03bbcac6068

AgentTesla

b383708f5ec6df8f7283f935c174c7ecd60585bb9535d860de3d7474225f4f76

AgentTesla

d25591f0627f988edceb12fdadef30e4a856b1fa016f10043cdf2379ac234b2c

AgentTesla

error

AgentTesla

fcb6030b15822380735483e1911f0148961b7f7cc4a9fe30561825ed3cd22dbc

AgentTesla

+ 3'924 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250809-psrplsxtaz/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

External_IP_Lookup AgentTesla

YARA:

n/a

Link:

https://app.threat.zone/submission/34533c3e-c569-4583-bda6-890bc52c9b23

Unpacked files

SH256 hash:

8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99

MD5 hash:

5eaf0abd7ada39f208121d7d3bd31969

SHA1 hash:

725a8c839c8e78f5f611fe4532d4df45f117c530

Link:

https://www.unpac.me/results/069568c7-2893-4ae5-b7cc-1d92ca69cdbb/

SH256 hash:

d48ee1f6f04504d641c8769aeef83185c8de8745458a3fbc362cd53c20ef10d9

MD5 hash:

e89f78e780b64eeb920d5dfebd033ffa

SHA1 hash:

b964dc9e8f5350d3a917b6a26b58853099859d8b

Detections:

win_agent_tesla_g2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

MALWARE_Win_AgentTeslaV2

Agenttesla_type2

Link:

https://www.unpac.me/results/069568c7-2893-4ae5-b7cc-1d92ca69cdbb/

Parent samples :

ff8ed2fb198f232f7916240604c204d1e467103fda567dc287dd62ca3d478d76
10c2aed16bd496bca57f3cc817ad510cc0201ac1657fd75dde1377ca038a9adf
18bbef8347972904228a700b1ed16a560400d283f27b615730414f958e67045c
a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2
627830b9debfa8a0a8a9cfbb89c90c0b2bd236ebc50f42564a0c91ce4edb3943
b772162c5b510c5427be045abfdc43c29756217e2ed924ce4c4388bd457a4987
115a0abcf8bfe4d0320ecc08c9f0668f35dd796b7a74c6dfeb9d6fc7dc16d214
059bcb12cc9e2bda28d0459a49958fe9efd7e13809b4b19a4d70c5a71bb41522
8024f9bb6c58be103e60c07bf09d3648b61bce12dbfb6277b18a85fd8a45bc4e
8d15bcc5eca4dbafc31d1ea92c4d34b86e5d30e6b4cb0da378570bdccd7242c1
6a31f54219ee0ddbfcb2aa841f922d48a849b1b047b8693ff8c2faad2ab8fac4
979e6920fc27cda0cb462b26f221a6e521e3974ae737022db7215747f54ff349
3a32996e922e69d2a01101f0fe601687d8d98f6392cb72cb984ad86b03f8236d
f87529bd57f54630ff4e0a8391d2e02bd04df4b83ec7c2b879dc258f81103978
d48ee1f6f04504d641c8769aeef83185c8de8745458a3fbc362cd53c20ef10d9
ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5
86e6c344630b2458ef31796359d7c14538e95982c87c803d1ffd328f2ac2bab6
474651d4f8f510094648423d6a0d97b51d2847db856251740877331e101dd372
46a2479daf646efcab8cc6fbf8037d37703dabfc6aee279465e22b9a433c8c08
363da150d891da7bb5da8056414882429067a0fcb27f58363567567bf18a323e
d2d196a12c822020c4042d607be77746951b6cb3c16201ff21ca8e9c5c786209
dea077180d1a981a1a9bd8f901bc177236825f173e5e2394161811797933fdc2
91fee98b5957d145f144b61107ea0283fc3e02eb7e19b432e868ee45ffdc528e
35931dde3f9e60ae4cbf22e5348bc4afca8d6145137a27a25216edba8b66f68e
0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9
1e6a8f176a0d7a9bd0321b4c032153f48b244be1584137453bf1afc07ea10157
80cae17ac36cdddcdd35027d72f10d019d82e256fe88e0113c66432137f354fc
97a8bf73809611ee4048adc2714685bd29bba3e677f5589b1053e30e0d98cf53
18b7930562b9f73f383204f2a09e2a76ab3d772a0d3813ea42bbff257430b5ad
811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b
382b40ce3e7d7fc44a80d1b9190914a401c968be78c7115a8e4e3ccd40b8888d
996a678b9f2d2434c6da9452449c3f21aac4b5e15ba7ae8c0a5ecd429d287e35
89260b07ae5d0858db8a14a8b7cd9e2c1bcd064f5596e7e0cea1665c7f0c496b
ac0c869888d9501a709cb33762d8062ecf7139116a4c0dbe07171f2c5a77b96c
142d4fe66ef8acb376f52ae33ec869d8782a4e63f9c92a6a20011dc9cd8f215f
5fc13e8395c7c4714caacc49471c400b47d85b490c329699060acaae6bd24eab
35c894c4142cf4d35b922afcee66e1c1d1feb7803ff904371c3efc38d6d2373b
41bffb035560aeeb3d2f29aa841e7e720a5eee2aadb4717f5b874b54d07375f6
c101e6bf92c9106ff2c1f2b729c6f8876296570a2c34579755e0ed4b6527ef69
6833c243605f2cbce11cb5bf26359c068588b9b1ac0e564bee019dd45a972b53
d6a552186e5681c84a98bb28235bb1a863a0877585e984b15f38e7dfd0619225
4206293a4d4e9b93abdc77721e4c1ba151656f25c21fda7677066e0e772471b8
2bfc56f2d75628c46bc823eabb6965763268b879a249993d42794624221cae0f
499e49eaa56930307412bfe977a827c0d9ab0c361b319f912e78a13b03154af1
86ccb2e2b2b1780ec85596c64030ce2525145afa00f9e3db1c3582c4f4afe7e6
8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99
1cb4254b1a62245b30f20ccffbefb79c36b1ef324c6d401cfb6d48ddb00ce6a0
1d6d55330b2acdf2edd8d1bf9f2f134ebe700dff202939f1c1b31ad5aef41118
10364e0c6aee6b43975fd53d6289dd7e6e0f7891d4a5636cb938f68e00717d85
c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8dc5ce1b016b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AlphaCrypt

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8dc5ce1b016bdaebc7d77a20cccf815a49840e239c33132d35504d03c5f6ac99

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	agentesla Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked agenttesla malware samples.

Rule name:	AgentTeslaV2 Create hunting rule
Author:	ditekshen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	MALWARE_Win_AgentTeslaV2 Create hunting rule
Author:	ditekSHen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/19888/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample