🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e
SHA3-384 hash: c1f9caeeed5f45a1823dfe6cd8495f44660c9361bfac885830844f9bc23e1f484fc3f4457707042372dbb9b4b272cf02
SHA1 hash: 2cc48d6601f0d1163eb25f4487bf963afb6ad75b
MD5 hash: c742b50d2f0fa02b94c32bb216e604b9
humanhash: uncle-mississippi-vermont-west
File name:ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e
Download: download sample
Signature AgentTesla
Create hunting rule
File size:750'080 bytes
First seen:2026-11-09 08:46:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'350 x AgentTesla, 20'845 x Formbook, 12'417 x SnakeKeylogger)
ssdeep 12288:7b5ualaMSPKw4c+F2Q6n2rkJrNDcPz16jUaX19uIgqJKJ7:xJw/+FV6n2rwrFcr1sXfTKJ
TLSH T105F4023863A9E702C4BA17F80571F23857B4AE8DF535C215CED6ADDB7828F046E14A93
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/29d5213b-062e-4345-84e2-b34c8fb706a8/
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/98595/
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Launching a service
Changing a file
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-23T05:16:00Z UTC
Last seen:
2026-10-23T05:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e/results?tab=lookup
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.49 Win 32 Exe x86
Link:
https://app.malva.re/file/c742b50d2f0fa02b94c32bb216e604b9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e/
Threat name:
ByteCode-MSIL.Trojan.TelegramRAT
Create hunting rule
Status:
Malicious
First seen:
2026-10-23 08:20:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xivstj375zjtrvnjj2hcuvbxpbidkjklfxpcmmrlzktmrrf3lrpa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/261109-kp1qwseb35/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Family: AgentTesla
Malware Family:
n/a
Verdict:
Malicious
Tags:
injector stealer rat evasion
YARA:
n/a
Link:
https://app.threat.zone/submission/704e2f03-416e-43cb-88d5-772486321c88
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
dotnet peexe polymorphic malware debugger-check
Link:
https://intel.virussign.com/intelligence/file/ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e
Unpacked files
SH256 hash:
ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e
MD5 hash:
c742b50d2f0fa02b94c32bb216e604b9
SHA1 hash:
2cc48d6601f0d1163eb25f4487bf963afb6ad75b
Link:
https://www.unpac.me/results/6d957f15-2c1c-4dbe-8bcc-ffab3066197e/
SH256 hash:
8ba5e5fc50d186d7224a0f4139c3139b3e7e88954ea6bd6a758790b82e032a5a
MD5 hash:
2c4c72512465ee78b0ad19d17ea2d155
SHA1 hash:
05495df5a63cb97b6bc65652f4bc9e95c29c0a37
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/6d957f15-2c1c-4dbe-8bcc-ffab3066197e/
Parent samples :
aed64d1a94fe8182f45f84a8f7ba420b90b076c34c448e141d11be350bb728bf
dc50ab477a38a56cfcce2c3a630f309b4d39c555882845702ba5eb389fa53f8b
b2b362f2c0cf692201dcb08dc12f86ea80e94f30586569bff5647bafb232dce4
ea31e23771249925cec49d731598cf69a9edc2cb883e8941832ce47a8a897492
7e6854f052cb97be92d9e7e902af27dadf63a1d89d97df856c6433e15b35b08d
5431d9328694139eb052492c1f891aea28d6eee2ceab442501efde5b50a8e20a
455edd5f0c9fb584150689fe4134b72166210c982d6cdcc3945a8c398791ed81
7306389f13becd510de6c1a5cafc5012200394fd48d9735b55d421dbfc2ccf29
911b4fe6d1761eed5bc7ade69ac55b3c8f726cbd7e3d613ea34bd2bbf107e9c6
f8741d3a7a19561b0c04436efab2f43a07a5f38a04ddcc9f45b6019ac627d6e0
44a7cba81a611e798624ffab187b137725a5b7c0b80e53160f32839f01c7093f
e5126ba96da0decf071eaca32fc68fcf10048f70dd35398ad6e2a1fa773b26a2
a6a7b0729dfcdd824820293c31ac1c8f3bc2e384da986921f3d16594f10b1bdd
2a9eb929cf3a094c9f04346c20f63dce4c65bdc84d99cedd8952f279f497285b
5240b38a9efe67747c29da0026e03421942d4bb76d5619ed398e854480f6a076
81a490067ca061d838ba79ad02b4397acbdf1e90a85a371f66ab3cda13b844a3
de8e4550241c82dd8addc993db679e5eb9ec3080dfc74eaeaf0fbba20aefd73e
6ef0475a2947228b255910ecb1afbfb67d84422890530465af83dd8962b511ea
d49b5ed99cf590c2960fda247fff193c76c75f6cfae84c15b00562f1c6494837
a52cc2e5327e48910cccb0a723622ae520cd92a541f3a79ea6d0e526df46dfe6
7a024192fa8412e5dded4a28c9cc031870a9a1391d6b04e312d983c14180cd9d
450c84d19146aff4e5482bf9f263bed79ebcb2afcda896f2bcab0bda7848f81b
2545a93d9e794363f95aafcba44b1e791621e801ac887eecd44ed9b5f2273195
75fb29fab2cd9003d68c9ae9a7c8e223d7437497ce5e4ea094158bc4bba198ce
3f4b6451af04b1d6d2b34f017a9baa73671ab6f92aaa921ffaf1c799c6f3a794
477d6810f64e552158e073e1af947991e490cd5f4b774205bbd3287bdd359d79
b6d03e3f9c178c77eb32e730e8e690fa844ffd73f49a8fa0c6c37ea09956e299
21af7d776011760bce54d51cefe0416d26888701696ddff544a5f6a307980f43
291b8700ff0080732a7da994fc08fa6f5c420f562363e106f1137bae000ac22f
1e533b6f4417c95761a96e060e12eef541fa3dd9a8c5b3888b86e99666266399
12f520907b6193f628d959d05e22bc24032b7869ca805a1a8c331e0884202daf
a33f6a6d2098a2be88895b24bd929981ba301079c993af2ad0119e207ade7474
70af9e596e3852310c462130c8942b683ee9b5f3b3781d61a53e097e580e0a65
42042cbfb880a7312bf79970fa34f28d5efc05e78c59413dacf356c3f5f1334b
8f151b1483d17650fef6a0b07c95711a229d7b7cc5fe4e5c6c02c06bcd7b476b
3c217eeecaa616ad300b86fe00f2ddebeb05cba3dfb4c33f3c716f0f162c282c
1216a457ad6feba882414c1d842764b2ef56b281cc6d73248732a8b5f96cf37f
f813713233bd1beb4be5a65203b99b482c94b6305c4bda360bc1d356d1ce78fc
dfc1d6d6f5686fd52c59ea810da291636b0f8cc29f1db96840eaf96996f04252
47bb90ea40b1be56918d2531bee35237fe0f37a3fc1f996428353bcd5f012200
a70018ec113147b33ab347a6a51f7d7191d0963ba562990a721d48a4ca4e0335
50e6700881ce6280d7d69faee5b3074d562825b5d08bd44bdbae8f44759b359f
47448fd0ccf67409e249204ee16ba679f3b5313d233feefa9a475c16879a752a
623f3150b2ee354ff03be6072f64ed51231879ccd4ba5aa40b51809e2923b904
c262c623a9c5438bda0da6ef5278ac7f861e61df407536d84c8fe2859deaff31
7d12f42ac9f97d3a09d221c7df4d223c5aa6773fee75644f96c7d03651de8f3b
f740e01f7192df9e0f5deca0ab11590e0bf1dad63f0494dcf86567e6cf42d49a
56905ea84b24a2f6740cb80d2c91c8e534c1312dd96e8c339148fe887e38463d
63272bd0f4681ec11068ff99e6b9cabd771cebd7415eac995640ade08f30a0cf
5e7e2515fb2d19a5380db86057cd8153d2c607cb31b6e970ed59eb25ea660cf9
5d68406988e8402359b387b83cd0662a50c0f5cf0253b17bef2ccd048d3f0931
aa6e0b767b4e2262d30a20563718c3f91fec7987b215179737364a82cf86281d
ce375c9c14f4a341a301911d495024a1e68f33b3158c91dfeada6969ee0b43a1
299cf4eb921023775ed82cdd58aaf3f25b93cde115bfe08db81b5caf920ec864
ba0a626bc1d894a1886540e79ea8649e9c77df2dbeefc8b277b0ac3b1880c7af
cf5f464e1a35e7b6c71a0826af6f030b7127450f72a88aa30d3d4a987b6cb0b3
8c46e04a549d712d0cfe5c211d7f076ecac04465f9f4042e1297e84fee5cc878
d0784d2c28146b4ac5643ce9b9603cdaa915cbd19f3ea9fbfa7c37bf2f2d31c1
14a7f72c25ffff77b6facdb4f90ce64638d2f82776e7dbad4e8beeb1458e1a24
2231926d380c965538fc8ba61da10340112b078a2d236dbc57a7f4068914638c
1e8b81308a3281537190f9b57a09a54ac14079db8b412c50f7383f58492923e9
b4db6573c58d96fdb3f716214ebd4669a800599028cef93faa957b560579733e
00f374c0028c478cc4a31907416f6530abd82101e818ef6f487f57023e295d00
72901d19790006381b9c8564662e121de967f7577c388f6590987fcf5a418dab
82b771e68d450ed22fd3d35e2b3487a12458e4af0213e73f749424c2077af8bd
f2efa11e65d3efc964f95410e47493617058fe960d270812bc5b8298973f9339
17fb280cc5ad5829eed30b6ef0438b08b42768bf1a44330bf75bc307c2fb1073
447eee97b490f5675ffa9fda574f3536cdf9284c02c279828a3f2177285f340d
a6afbfb73f3f623bd3446a827268f85305f90a663538b4065a77928e13980885
d5e6c1701fc50eb899da507f089c2d9a5370e68dacce20a0b449c46f37f5d773
331d2124277c5d99dfec9abc75b5974046ba34175324f7ecb323c650ab2bd204
e02a15c2e5bed8b4a291e3896ad5c5727af9377be6539224736921ff0edb086d
e122c140ba89d1b62e3eb5adaf121f2fc4601e51af45d1520e2fdb4019716576
1e231359c031964c550da8140c3145c35a629019f4fe21097f0c7032da892904
15d9ef2f73e09e448c6045915f93357dc56b60d95a342a56d2145ab100532389
1e15d3711579966e16daf57d28f4948d2828b940c22de252a9c496f46cb2ce20
219c7809c2b711a9a6264866ad2e3937129eb3d06db383fd2edb5200d199e1f5
280a3c66999323c6ce010b17b56a494bd765a534daf439890b9343eea9a90dfc
f4a95e8c83051329ee4177a3c675a4c1b25019696f794a753cc15f025c5ea3da
fc8e645b69981d2435545cbdd62c20db78f15e42741bb1fef5dde59a213c45bb
d73db781d3ff2da848bf113fd247e991d0ff5a2e885f439be4c33322a4a563f9
243711371bb27a7485d7d6d48e9ba97b294be3ac2f59981635f0d4954271bb0d
804ab1502f676b6cc07903349ee3919929f2aff261621f59ab6a27c29d0a7004
c59fcad9483f6f071f0c182c2614345617706f058a2b5016a3af03a661e6618c
9096b754b4bfef1c735a9b9cb30bd00de6ea6e2d29f3aa95197d10b2c3107c96
9284b48dd34da574cfbd8798e2cbb52ffa6a212d1ac799e1907032ee18efacd1
6685f73970af4af3f3418b81cb68fdd3a27562e436cc7807b19320d72ae9343f
4d9eaeea86e4598883cc5188e2fefad4d907c8d3210e74ad75b6fe6127b6a636
158f0ce62624a66568b97521e37b61e1b9626f947aca3066c273a79411a594d6
f895b63ae4371ecebeb5fa4255477be1b64f63cd405278a9336cf05325283be7
d7c74b9a0aed77dfa8186dae25f4d693b1535e0f86a65ecd7bad4b9301cdd6f4
12e7d0792c32071503466696fb7cd187d0b36e4f23e6df9a2182e15a9b66be1f
7cc1c5f98afc6c1d7368ccbdb601e2bf00c2b919d8a7f26eab5167bf2308b841
d712253a4d06dca2979341d8822a7862a923b913885c22f75f4ab5fa8ab1cc5b
d854c2453597672e1512ad67bf9d9300c93b40a2ddaf6e262b559ebac3733486
162184d06f8aa486ea049c2a9d21dbdc36facbbf6ed9acbb836eba0880e94985
a767f88ed6faea47e46ca08c055b30c4af53588aa90eb947652937742416a183
08706343532e9b1d7c07761769c5b674f07a628c78838c7e5448b83bd3b17a8c
cceecfdd020fcf3c68a75a032caad14918065e9e9ee3da8b45b36cf386753ff4
ba0bbd02b6acd8a9acd0f9cf7429af89cd52720b4db180491411a286b45d4a9c
4e58ab615743493b9f8f21f174e8c04199f4d69ca66d00f0c20a0815ff5ec699
ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e
d5181cf2ebef9771a4ca51e62ae0ccd1acba6438926f476189b23f35c6b6b2cc
SH256 hash:
26b896018bcca651351f8393d66b4aba5dadb8a9a46931c38ed3eb44a68643b1
MD5 hash:
4844e535afe9eae4f9de8c5c774abb17
SHA1 hash:
5f7f1e2aa2a624191de5b840c5417aa680456a75
Detections:
triage_agenttesla_infostealer
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/6d957f15-2c1c-4dbe-8bcc-ffab3066197e/
SH256 hash:
d12785396646264a6aeda2d5422d8b341f2068688c97d29464b5754719eaa5b8
MD5 hash:
8995bd227712cc1ee31a309526ee7fde
SHA1 hash:
f825bbaaf64d4e90bd665cbe6869682e5a3f35cf
Link:
https://www.unpac.me/results/6d957f15-2c1c-4dbe-8bcc-ffab3066197e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba2b29a77fee5338d5a94e8e2a5437785035254b2dde26322bcaa6c8c4bb5c5e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DotNet_RGB_Embedded_AssemblyLoader_Hunt
Create hunting rule
Author:ShadowOpCode
Description:Hunt .NET bitmap RGB extraction combined with embedded resources and assembly loading
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:VIGIA_MassLogger_d461b6f6
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:Original-sample signature using corroborated application identifiers
Reference:https://vigia.bisite.es/
Rule name:VIGIA_PureLogsStealer_633d2bc3
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:Sample-specific detection using corroborated application identifiers
Reference:https://vigia.bisite.es/
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/98595/

Comments