🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df
SHA3-384 hash: a01f6eba8ab607b66cdb9f3a98e5197a69bdfbacbcffb5fe1adeec2e5c72e1b7be780f0a2ea7ddafffeb679a5d3a27eb
SHA1 hash: a76894554c1da14d5a4355a20bda3b4b1911dac6
MD5 hash: c5dc6a44af7a7b465f7b356f03116fd3
humanhash: bacon-friend-nuts-white
File name:907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'053'184 bytes
First seen:2026-08-10 15:01:15 UTC
Last seen:2026-09-04 20:13:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'616 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 24576:5eA9sfIew0L0FxUhA8eQrT0UHvZI+LfC:gUsf7CxUhXrVHvtrC
TLSH T1D02502982B5AD613C49497B80A72E3B4173D2EDAE401E30B9FDDBDEB763AF454C04252
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
192
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c65138d0-41cc-4a3a-8409-ec303a08611e/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SVR26-616 - PDA - MARLIN DUA - TLP.exe
Verdict:
Malicious activity
Analysis date:
2026-08-03 06:24:44 UTC
Tags:
stealer ultravnc rmm-tool smtp exfiltration agenttesla
Link:
https://app.any.run/tasks/fab4ade1-0888-4bfa-a2e3-0544cb2f0640

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/80127/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac1c6f67521726fe3d73b12
Tags:
virus micro lien msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Changing a file
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
entropy packed stealer
Link:
https://www.filescan.io/uploads/6a79e7f22b1816fd61bc2be6/reports/252dfeed-2ac8-41fd-8361-377d98a75731/overview
Verdict:
Malicious
Labled as:
Trojan.GenericS
Link:
https://www.hybrid-analysis.com/sample/907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-30T07:59:00Z UTC
Last seen:
2026-08-12T11:48:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df/results?tab=lookup
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df
Gathering data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-07-30 19:20:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
28 of 36 (77.78%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
AgentTesla
Create hunting rule
Link:
https://reports.threatray.com/78cbb791-c6cb-470b-97f4-5255638e3d3d
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery evasion execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260810-sptlks1hng/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Modifies Windows Defender DisableAntiSpyware settings
Unpacked files
SH256 hash:
907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df
MD5 hash:
c5dc6a44af7a7b465f7b356f03116fd3
SHA1 hash:
a76894554c1da14d5a4355a20bda3b4b1911dac6
Link:
https://www.unpac.me/results/4339ed69-6716-4440-8ddc-bd40b5cadce9/
SH256 hash:
6d4c5bc731b2e23fa90f0d8e916c17f57c4bf3d38278b1d02bb560cb19b85091
MD5 hash:
cd2fd8822f142d3a5f9d51f58967a218
SHA1 hash:
7d83a73965e5cdba3ecf738e3794804d3c98f8c0
Link:
https://www.unpac.me/results/4339ed69-6716-4440-8ddc-bd40b5cadce9/
SH256 hash:
4828056c4016868b6c32c751b43ad187793ecfd74ac9dad239d62fd6c13c3a5a
MD5 hash:
a317aad830faf1997358fdfced9cbc25
SHA1 hash:
8d45d57faba4d4f2e364fca9fc27c67347703eb2
Link:
https://www.unpac.me/results/4339ed69-6716-4440-8ddc-bd40b5cadce9/
SH256 hash:
53e615a93c170a604a8f43d138347a0979f9ae9d9b23d5dd4c3bb73eebab14ec
MD5 hash:
b65af239e5a675657992fdc7245dcfe3
SHA1 hash:
9867e1fd642d01873a9ccdcc2361d5b658fda450
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/4339ed69-6716-4440-8ddc-bd40b5cadce9/
Parent samples :
e6d21c7f70042be1e6ebd793d468b6ed3b7303bb1ebea404f1853367da412fa1
505addcb02a473a950e2fc346435bdddecdf539b8719ce3ee9debc7970ac55d3
269de0e65190026ded5ec7b2a27ca655722c107bcaa7072fb09a8240ff29c233
8a83917310bca7fa86b7532e0a3a50db2e9055c25501f348c738daf6262bb303
259c9097a874797d7c06c733a96b81325ec2621a793b08883fb86583c1da4938
fae02b043db75f6f4e1e5eb15b03d376b27ab77ba78e95255ca20104cd387d75
eeaaf1a831b3fb078825892380b43e6f8616edfe4434cc0950bcfddb289326c4
907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/907dd5d4c793/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/80127/

Comments