🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018
SHA3-384 hash: 63d1de5fbef4891df42d156d0b89091c6b6c401ecf9625b05eb790524736512acb7f41ebc04aef7d84de37d5e2ec1c1b
SHA1 hash: 1bc24f2bf909c5153f7261b0204f736c1d115e4d
MD5 hash: 6983a403a5126aa0b0be39f8ec777f98
humanhash: william-jersey-hawaii-foxtrot
File name:b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018
Download: download sample
Signature AgentTesla
Create hunting rule
File size:814'080 bytes
First seen:2026-11-09 07:57:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'350 x AgentTesla, 20'845 x Formbook, 12'417 x SnakeKeylogger)
ssdeep 12288:6vf6SZzpX8zmGGTsa4TST8jMIAWIXWiJMlA02f2DFhSkQWt06wmfPBUyD92RX:6vCKX8jGZnYViJ/f2DykK6ZuyD92RX
TLSH T10C050214325ACC13E5722BF40970E7748B745E95A961E3D3CEFBADFBB96A7805808183
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon f0e8e8e0f0b2e8e8 (3 x AgentTesla, 3 x Formbook, 2 x SnakeKeylogger)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
48
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4b38d4e1-2a96-4fb6-a212-f63ad6d7aed7/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-09 12:59:48 UTC
Tags:
rgbloader loader netreactor ultravnc rmm-tool stealer agenttesla
Link:
https://app.any.run/tasks/a4ba1baa-763b-4f11-b81f-d44ec0fdf09b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/98190/
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a service
Changing a file
Blocking the Windows Defender launch
Stealing user critical data
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-07T22:52:00Z UTC
Last seen:
2026-10-12T06:09:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1a5637e7-0f8d-460f-bf44-b87b75b5e2a9
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2001335
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.24 Win 32 Exe x86
Link:
https://app.malva.re/file/6983a403a5126aa0b0be39f8ec777f98
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-10-08 04:35:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
28 of 36 (77.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=waik6t6ohfcam3ajh7qaj7zmargxwyttjqvvas4j5scl37gweama._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery evasion execution keylogger spyware stealer trojan
Link:
https://tria.ge/reports/261109-jtfqvaxzf1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Family: AgentTesla
Modifies Windows Defender DisableAntiSpyware settings
Malware Family:
n/a
Verdict:
Malicious
Tags:
injector stealer evasion
YARA:
ConventionEngine_Term_Users ConventionEngine_Term_Desktop ConventionEngine_Keyword_Client mysql_database_presence
Link:
https://app.threat.zone/submission/b7490c1e-07fb-40bb-ae05-f0f1f708f610
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
polymorphic dotnet peexe
Link:
https://intel.virussign.com/intelligence/file/b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018
Unpacked files
SH256 hash:
b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018
MD5 hash:
6983a403a5126aa0b0be39f8ec777f98
SHA1 hash:
1bc24f2bf909c5153f7261b0204f736c1d115e4d
Link:
https://www.unpac.me/results/77d1d128-24ec-48c7-9e50-84f2eb7cc9d6/
SH256 hash:
936bda58a60ecd0e6c4fa27c1d10b44ca880d52afb4e04a4b24b7aba3c9b1d8c
MD5 hash:
c828317c6ee308f53329a9c093442fdf
SHA1 hash:
0fc4c4e4b6ff6b5a00edcdea86b697068ca1e2f4
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/77d1d128-24ec-48c7-9e50-84f2eb7cc9d6/
Parent samples :
0f8976cee8d60f7c8c2826f36db4a09f30fff94effb652cabca2efda9b4c2bf2
2bf6f5c3980821264bc2f8e4ccd63dc770e770792596e7f7f88b4eb84cee9748
83dc792b38aa2f9b6f560bf9ef0a61e03f149df3572f577bca89eed4aa9fe9d8
d218db9942218730594893bc74b20b83d4b78631c5500cf52633699447cffbf2
f4273ddcafb58aa87cc1b0c00d2bbf5fd6938e6493eb5520939371bcbdc3ad83
f4a6b1275b9b10e7e715597c711b74e2e9a218d9be60d46f91f30eb9f9ba939a
4169d23c7b32f042f8068f47c02b8783b6537c31260d15265a1a0538879cf95d
6cb39203aa0064e7b7831b02bcd9f7a511d6cb7b4434c995fb4af2b5e72055ce
b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018
SH256 hash:
405d0dcbe8454646de26e8b2db78435803b99dccdcbcdaa1028c56c7c0c6c3ec
MD5 hash:
3e3fb75f3074003ae2ff07ecfe6fd38d
SHA1 hash:
5200f5572d3167c84842bbff7c48506011585172
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/77d1d128-24ec-48c7-9e50-84f2eb7cc9d6/
Parent samples :
64506ae267aed8afa5cfbb41ca8f5677600747f02fe27b8d8d926d12e3ad99f2
354ed74cf297bdc4d920e3bb357fea7202856277501cbe914b1dfbe8813e841c
7a9bffbf3a920d9b72d73b73cf09f3be5dadf025055f42b5dd12761ab7c8dd34
461ba9a7d6b344421967b3c71630ec4796126b5f20bef32111447ac58e9b9202
a36cbacd3c6950de6319523835e895e8b35e32549c3a4673b3ead5215ad0d3e8
a8a6f5ad5f6bc59b64af1cca3bf0d5b6bcc8686a0dd8a8bb5cb244c2edcf3e23
4e2d3b193a9bfb9f3a369a251a1b722450fa13d8fc193d3c872ebf1062783fde
3ea03e28c0a5a8c8a4910f26b2a1ee073053f76cbd9d21729dcec81543ac1617
e15e5d4f77fa217cf9ccf18fc0fff19e9b9e47d8c65413f2751904a14fcb8658
024d5533d9cd346418c7780706410fca28f88e33291e8ca6b382299dfea043da
db4732a4b2646f6ddef351784943f58c27311215807a9ba670e9f687366e2a43
b7e0ed86028fb5faa05901945ae751051dc29ac8729b1afc62cc6efe17e20c0a
012ff5e0a2bed3ffa624958ccbc9da37a26f2fb65e3b994fec9d51b2debd2e39
0264d0104ae89e9c45fd1ebba3a20425e8f41cdc16e7deacec9d9608afcf8230
08e7a6e924c4e87cea2db6050812e058786714e788957cf0763b7d68943068c0
090fe0632814513fdece4b3c602cbcb5816f8e6b0b7a34ed73430ef6816ca227
152d4753839330b04a221d9e97093de27dcf5a4231fbd948940da26d909dd5b1
19b4de88df623cf3d95a7c3e84cdb51070360c4127322b5a929e9143d242d7f0
1af881666fdf368406d50e86d289b42853d9fc220cace6e82c5f0ee157d9bfae
297dc82be0b18123280967f224ce6ca4843b22e3b1bed07eb82cde8f78cdadef
2dc39c7548cdf4ccb0f00d94768aad3a3031c1ed29a24a59499bb6d558808c26
30a633cd9f1c25e9f76cdc78c3565462f14a444fe13f0689fe41de2163a89bd0
35bb5a32f866cf66288451eb5f04c568d58ae85dbd5b876abdb84932275215ae
3cbd641a2454d3b71544edd13f8b1940df511f3b9720555519bdc9740adb16e3
3e2aa99f1b2a0d56f34f65de5dcafafda48c23433881aba479bae67072059b56
4018da487297614f041f01b5bffe425f6a4ca43b045455b4c4ac20c04b92a61d
45d3d2858dff39d3c088b51b4b4c9452e562a85edf68f4d135ac0c69e73a0d75
4cfffae6cdd242838185f34113b65421a41ee3fcc726b8fa63c05d607164af4c
525ff77b3b29ecb04880439caf8dc43294ec447c4c1baa14d54e2eb27aef7606
5390935b00b4bb841bf005d0e43b603a78139295ea53b471230d24bdb5c423d1
5aee04c320bf3ed7046702eafa8c4e193a614981e955c98cf82bdb675edbecdd
5bf661ed804f6f8e0f65e3f8d3799873f72de9d486a5ffd71b79a62012f1fd83
676e61504a6d6ab4d90b5068bc487fb19c804b0b1ef0db814aa04fbe035195dd
68ca49836efe920aaad82f3db71bd22a9fb5bf72490f1535f1f7f2697f120a55
6ad2165eaa8bd199768ccd7dfe74a480e0602bd57c6a77501d01faebadb85e14
6bdf803d22cfdff13e317894ddbec9076aa67d85422414ee7d12a1d44c6b0fc1
6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
74615f020e5952fe66c8367ca324ce02b0ca3e98bb17327cb159181830b8e23e
785de4b2439f127566906ab1abbaa80562fdb730bc0e5c3f4d0d0c6a5af5330f
78ffe41ede09473d54e4808e703eac44cd6e79e2314c84ab4539c57ac0bf4033
7946937f5c65fe8d9f39b927c9a499917e72d88640cac1e34227758f241413c5
7f69d304597c8b10d0f5516fae40ef1db11030d68778464402d3cdaf3f586b41
86c321273fb1bae6a89344a1b8982b80d13c0774bb76a0e3cdfaeab1c4d5dd17
88f4f68676a0adb716b617a6276bc4f28bfb1fc732daca54c1582f70a124d86d
8d93bc348fc3702b7b5bd244f0a1fca04cf34903a72f18cc883e6b1333722644
9d66a32be3f221f882724bbd6aa9824232cbaef71ea46243b1c6927a9c569387
a924dc51efcc327e23837f61af68d2f793d36a36183c3cedb3987efca8382583
a995a81f862dc9994a8021fecfc55a7f8261974f50793e7bd8a73dab5e6b33a9
ab3d42f5dc68cfd3507849160e1b5f90589c49f1bc8aea1226a1dea6e2824c05
b059899fbc3393df19a209fa6c7faa35de15b2886c51572828f7f1e1d1088e87
c053108c5b25c38bc6d29569d2876396f4e744cad3d867abf4e566b3e4c3c384
c520275b04c1fbdabdac631aaf4141cd3fd8bc485aa9cfaed7c65e7ccac12c14
d5331e2c9e5d866d4515c825d6eb69de927810f8547fdc9dfb0aa545785a36b6
d86753e540f7ec56ae0e03335558af87e536c03bdd7d93511a5521ee28605341
e13ed2a8812eac03651272dfd4ac6a0431305ac845210907bea692dc59105526
e357b50c1c476180923e06378e54a7995e7966dbd633c3fe6edea1432c425833
ec340fcd3a19f99978cfd326a00108ce04d9c295ef61723dfe12c46fc8be21b9
ee173fe306d7834864d41b0d02327027a736c2f8517a6831da52b1b30e9a0d72
ef731669a765d81e3afae2c4f04cb729dd28c30a8fd60fa800ea6e10d2732011
f5b83f8a1394e025adad0de20e351321020d7d24b98ceafc9222b71c6a6f48cc
b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018
dde77593586fa82fb49bacf8ad2356d7995124392b7eb2b28a09e545467bebe9
e5f70d365cf4d23800ddd8b903568d2233c6cd42084c4a3cbe85768bfb39b45e
65facd2137c0c020e93eafd0b116993c25e34c1b5d9c70c1ee340792dc79b672
77d0122f32c68f059bba2257a58fb196ec72f6184c2445e5c0302cc504d01d6b
774e80db5578ac7a5407fbf24b8e84ebf346664f3c27b7e994043aa674f00514
a39a6be5121b08174f98b5561cda00e92eb10f5109f084fe78b6617152fe61db
d5990015984c1e05ce9f2c6d04f0c6c545b7d9532ed941758accb0654b020c7d
SH256 hash:
99b87433167f612ae8707f15135a666250086785fb070a4b6d855d136e52d69f
MD5 hash:
950b7038ad24f56d81e98a9b9e8acc28
SHA1 hash:
880277b641a0138e5f87bba6967f23f1f0daf882
Link:
https://www.unpac.me/results/77d1d128-24ec-48c7-9e50-84f2eb7cc9d6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b010af4fce3944066c093fe004ff2c044d7b62734c2b504b89ec84bdfcd62018

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98190/

Comments