MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf4ca953509256578f1484ff71aee4ad84e6598de24134e23e189d5e2f9468dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 16


Intelligence 16 IOCs YARA 24 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf4ca953509256578f1484ff71aee4ad84e6598de24134e23e189d5e2f9468dd
SHA3-384 hash: d99e4b40af3e6675f527f322927e05e5b674243cccc5e8a86b088096a2fe09012a1ac80cb9a9b2510c5df563e7b6ddae
SHA1 hash: ecbe239696fc61a5d1402972139963a7545f0665
MD5 hash: 936ecbba0358f6c7d372b4b163b17027
humanhash: skylark-lamp-seventeen-venus
File name:bf4ca953509256578f1484ff71aee4ad84e6598de24134e23e189d5e2f9468dd
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'046'016 bytes
First seen:2025-08-12 14:03:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:dtb20pkaCqT5TBWgNQ7aehPt4VGNdB6A:OVg5tQ7aehV4VGl5
Threatray 3'250 similar samples on MalwareBazaar
TLSH T11E25BF1363DE8361C3725273BA65B701BEBF782506B1F96B2FD4093DE920122525EA73
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
21072025_1630_21072025_NuevaCotizacin_00261.pdf.gz
Verdict:
Malicious activity
Analysis date:
2025-07-21 16:36:22 UTC
Tags:
arch-exec evasion stealer agenttesla
Link:
https://app.any.run/tasks/766b9ed8-919c-40fd-a3d0-3a6e752f195f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20479/
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b4accc633abe3908e4b68
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Launching a service
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context autoit compiled-script explorer fingerprint keylogger lolbin microsoft_visual_cc obfuscated packed packed packer_detected pcalua threat tracker
Link:
https://www.filescan.io/uploads/689b50ce9ef4d2ff7cf887bd/reports/1071c8ae-8e4d-498f-afe9-4a5c03367c9d/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/bf4ca953509256578f1484ff71aee4ad84e6598de24134e23e189d5e2f9468dd
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8e4fed82-7406-4d1b-8d5e-7e6dc13e96f7
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/bf4ca953509256578f1484ff71aee4ad84e6598de24134e23e189d5e2f9468dd
Gathering data
Gathering data
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-07-21 12:28:49 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5gksu2qsjlfpdyuqt7xdlxevwcomwmn4jatjyr6dcov4l4undoq._file
Verdict:
malicious
Label(s):
autoit
Create hunting rule
unc_loader_036
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
014fd6f8c909787cb697b4a440b07e4a567dff6a5cd78e9f70a0f19d5479607a
AgentTesla
36714617ab3acacb11df096fb64e7ced344b241ebfdd501a60077c931c89577a
AgentTesla
61d6d15b22aed7572cca9b5785f07f02eec562a4142c2fb8605dabc89d7710b5
AgentTesla
837fbe9b83e066eb57abc2f94a7bbfa1ce5c6189bdea605a9c74bbb11cdab57a
AgentTesla
a39ada8e971d67fb725632144587cfebcbd96da06f29ae39d69214f7a5d79234
AgentTesla
b0ad89d7346957e3c74a48f48298add375cc9d00066953c35e90222c298e174e
AgentTesla
b7268f9814ddac66d6a4c1c43115d19de4fdb23e4d30ae233aeb51127213a1df
AgentTesla
+ 3'240 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/250812-rwmaea1ns6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
External_IP_Lookup
YARA:
n/a
Link:
https://app.threat.zone/submission/0c20e137-b895-427d-82ef-9559f0dee397
Unpacked files
SH256 hash:
bf4ca953509256578f1484ff71aee4ad84e6598de24134e23e189d5e2f9468dd
MD5 hash:
936ecbba0358f6c7d372b4b163b17027
SHA1 hash:
ecbe239696fc61a5d1402972139963a7545f0665
Link:
https://www.unpac.me/results/7b004da4-b6b1-4591-ae41-bb32ae1e220d/
SH256 hash:
675762bdfaa0f7d6abf9e63c77c13e8ac48c19c865d9643622ecf7d651fc5884
MD5 hash:
c729e5ed858d90e51c5d82c9a3a9ec28
SHA1 hash:
8817326283e4c06e9863ce25ff303cbfe428e03c
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/7b004da4-b6b1-4591-ae41-bb32ae1e220d/
Parent samples :
c2df3d7537c43e85dfb395dd000d8c6f887ce891b9f05202406c44202823b586
b4a46f9be7587e5ca51f2a4c20e8fd08f39c2d0e36a9de245a11f90ef11fc08c
de9eeab3b5c6013da6e46431f20f865c15086d8708fb81a9da1e0de2629b8280
08379da65d80bac62f2bed130768e19210cf2344f74845a977fb8fa8237fb43d
abfeff23a5c23527cfc36df6a644b325c38bdc522eaa6c83c7cb072957f3b1a0
bf4ca953509256578f1484ff71aee4ad84e6598de24134e23e189d5e2f9468dd
2fe9c94efb856517f92bb543c65901ec76b46eaf1ea0d8ae7ac7bad689b9a0af
d9e52d9da6fe2b3a961b9bc07004f8a02190f41b17f6ba0473a1325d14e249a4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bf4ca953509256578f1484ff71aee4ad84e6598de24134e23e189d5e2f9468dd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:agentesla
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked agenttesla malware samples.
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20479/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User Authorizationadvapi32.dll::AllocateAndInitializeSid
advapi32.dll::EqualSid
advapi32.dll::FreeSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
winmm.dll::timeKillEvent
winmm.dll::timeSetEvent
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
advapi32.dll::GetTokenInformation
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadsadvapi32.dll::OpenProcessToken
kernel32.dll::OpenProcess
advapi32.dll::OpenThreadToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::TerminateProcess
kernel32.dll::LoadLibraryA
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WinExec
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryA
kernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::GetWindowsDirectoryA
kernel32.dll::GetSystemDirectoryA
kernel32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
advapi32.dll::GetUserNameA
advapi32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegCreateKeyExA
advapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryInfoKeyA
advapi32.dll::RegQueryValueExA
advapi32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments