MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 18 File information Comments

SHA256 hash:	9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9
SHA3-384 hash:	5aa87194cbd0faa0d11831012b395f13a16d4754af7213d7487927dae6ccec5fad2a5e43383dbf73c101d37e201aa4ad
SHA1 hash:	5369b017fb3bb7b08a24b0c91a5b993b0266e8d7
MD5 hash:	34367adf93ee12e6823624387825203d
humanhash:	delaware-moon-mirror-summer
File name:	PI for #PO22103.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	206'336 bytes
First seen:	2025-04-24 13:05:11 UTC
Last seen:	2025-05-09 14:09:14 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	3072:3EsVXmjL7nmy8a0kckpnyCIFxee435fNRl6siF8ctXuPE3JBhByjagtISCDwMlnw:3pmznJrC85NuZF8kmaGjagtvOw
Threatray	3'639 similar samples on MalwareBazaar
TLSH	T15214029C3BF9DF7BD7198279304509D06BF8F218DF9267036948027D2D633ACA945AE8
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	James_inthe_box
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

490

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

PIforPO22103.exe

Verdict:

Malicious activity

Analysis date:

2025-04-24 13:09:50 UTC

Tags:

stealer exfiltration smtp agenttesla

Link:

https://app.any.run/tasks/7e77dbf3-7c76-49d4-a235-a3c1c712a0d2

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/3864/

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.9866.8520.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680a381b3d067f848398da8c

Tags:

virus micro msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

DNS request

Connection attempt

Creating a window

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypto_obfuscator_for_net entropy obfuscated obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/680a370ea8d43a4dd6113a20/reports/9eacafcd-2df4-4aed-b5ed-343944188c3e/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/0fa8265d-522b-439a-aae6-d4fd1cbf4c69

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1673105

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2025-04-24 10:35:44 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 24 (95.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=t6exhdkygm3ijygnduyrd3hcrv4ozaxgs2jqw4s3ofrky3eppcuq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

b9aa15b40149a14595782f3138816babd5aa6a2cae761d9f6a2c1a7b52256bc7

AgentTesla

d69af24cb696c4e9de1910acdbced3b8f912e61591c0308a8de7fd798b86ecea

AgentTesla

e5bdca4be16a6b87ab30e8375a4de2cced94a30c65b9de56096b0d5805f35870

AgentTesla

+ 3'629 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250424-qb5qks1xhv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

AgentTesla

Agenttesla family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ac32fc0f-1d55-4236-a403-afc1e08381dd

Unpacked files

SH256 hash:

9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9

MD5 hash:

34367adf93ee12e6823624387825203d

SHA1 hash:

5369b017fb3bb7b08a24b0c91a5b993b0266e8d7

Link:

https://www.unpac.me/results/ea9fbc90-4a12-425a-9236-f57545d75135/

SH256 hash:

402b4b30788705a7c17eaceaf6158fa48744bc823c88332655d11443caa39fea

MD5 hash:

35a58b2a85d2f503bcedced81bb2ba74

SHA1 hash:

1df9285c5b4e026daf7dcb38ddf2cbbb08a86197

Detections:

win_agent_tesla_g2

AgentTesla

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/ea9fbc90-4a12-425a-9236-f57545d75135/

Parent samples :

477b2790123de7d0c9486a1942087c05ef26bb45eea5160cd0f5411cb7797458
9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9
fc0a1ad679e97793a6fdaba06b70d49018693deeb86ae54a0a450343f511cbf0

SH256 hash:

a1870851711ec6ba57c5f9d42c611d602200bf7c8b668a0e67b6128dbb376fc5

MD5 hash:

0bb803783ca80b02779cb1bfe9213643

SHA1 hash:

4c4310a75c93747017df0c4b5117c4a2b3a92bce

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

INDICATOR_EXE_Packed_ConfuserEx

Link:

https://www.unpac.me/results/ea9fbc90-4a12-425a-9236-f57545d75135/

Parent samples :

477b2790123de7d0c9486a1942087c05ef26bb45eea5160cd0f5411cb7797458
9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9
fc0a1ad679e97793a6fdaba06b70d49018693deeb86ae54a0a450343f511cbf0
8071a3812f3d0b94915c053ca55e56b11654d86634edb6e4ff119a163a2924ea
1f17ccbd43f941b1a79412d24ad8e60f33a916d3fe73c257d65d7954313f8f5e
d56f47c995f2b7727435d6f3f4c840aa01697939fe1c228e2bbbcfa196cf2904
f7095affa7e61a334e6abdb3655ba9a801d638fc7322c649dacdd48051146f5b
4cfe4b8ea8b615d55dc301a57bb5a1525ce4486c7fc6ae430c3e6fec5f301e07

SH256 hash:

bda6b3db8466b40c72979dd92126f2ff34b81d9258ce1c6d7a69aa6572d2f50b

MD5 hash:

254d3d4babfc0b4e6a0443e1e10a516d

SHA1 hash:

74544f48ec59ef064a03ae3d669253856f6a3806

Link:

https://www.unpac.me/results/ea9fbc90-4a12-425a-9236-f57545d75135/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9f89738d5833/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe 9f89738d58333684e0cd1d3111ece28d78ec82e696930b725b7162ac6c8f78a9

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/3864/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample