MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 90e4a4b341c0fc976c1832f1eed2ef6bbb0cc7635ff507ea574e7233c6655515. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 13
| SHA256 hash: | 90e4a4b341c0fc976c1832f1eed2ef6bbb0cc7635ff507ea574e7233c6655515 |
|---|---|
| SHA3-384 hash: | f3befb36621ae8cc842e32e0b6dedbe76743b6a7bec075a791dd57071fb3376b4c9b65388e1dec296697362da0351130 |
| SHA1 hash: | 0f41a7bc939ca93ccbd1b4375c38e1e1f8817f07 |
| MD5 hash: | 73ba8d807d512c3b912dfacb5a57cc7e |
| humanhash: | michigan-avocado-glucose-robin |
| File name: | 90e4a4b341c0fc976c1832f1eed2ef6bbb0cc7635ff507ea574e7233c6655515 |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 965'632 bytes |
| First seen: | 2026-06-08 09:40:50 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'012 x Formbook, 12'352 x SnakeKeylogger) |
| ssdeep | 24576:SEOp2g6zYF7nNAE9WdEnDqGLAlyx9u0myKOmoV8k34Q:vc0zKnNbW4tL+A6+Vf34 |
| Threatray | 127 similar samples on MalwareBazaar |
| TLSH | T1772512586E46D507CA905B394FB1F279126C6DEEB401C6239FDD7EEBF93BA520C04282 |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
65
Origin country :
HUVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Detection:
AgentTesla
Verdict:
Clean
Score:
N/A%
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a service
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Changing a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
krypt packed vbnet
Verdict:
Malicious
Labled as:
Trojan.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-14T16:28:00Z UTC
Last seen:
2026-06-05T16:05:00Z UTC
Hits:
~100
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Threat name:
Win32.Trojan.Masslogger
Status:
Malicious
First seen:
2026-05-14 19:45:59 UTC
AV detection:
20 of 24 (83.33%)
Threat level:
5/5
Verdict:
malicious
Label(s):
agenttesla
xworm
Similar samples:
+ 117 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection discovery execution keylogger persistence spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Unpacked files
SH256 hash:
90e4a4b341c0fc976c1832f1eed2ef6bbb0cc7635ff507ea574e7233c6655515
MD5 hash:
73ba8d807d512c3b912dfacb5a57cc7e
SHA1 hash:
0f41a7bc939ca93ccbd1b4375c38e1e1f8817f07
SH256 hash:
ccf46c2b6b782871ae730ab2dd12d96d8b8a167c36e8673767ab6d39a2f18f58
MD5 hash:
7be199615292f9d3636e17469625b536
SHA1 hash:
44a88d043be4e7294be4fefbd81f3c3d18e14546
Detections:
win_agent_tesla_g2
AgentTesla
SH256 hash:
3d71b161c67f0af1e24c5c2f62321dce2a3b422bd3e25f448c6200cadb0cc875
MD5 hash:
e21d9a085fd2f4bc78517a752712bd1c
SHA1 hash:
87b9249cee2bef6f4a2952c0417e32163a2f84d1
SH256 hash:
16770860f1cd7ac5dd7254949c759456f470cb2235d6d300badc535c12794239
MD5 hash:
05b7c2ee0633b97479814f9f70d050a1
SHA1 hash:
cc64df225223e48409669070acae49aeedba4746
Malware family:
AgentTesla
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.