MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 23 File information Comments

SHA256 hash:	c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c
SHA3-384 hash:	1e48f52e148c5dc02f94e43ba02608fc37e5a21e0f85c506a6f97728fd7702f8d7237df4c4cd2047e834c0db1879d4dc
SHA1 hash:	761e8d031a2306e7ad862e8a3e1a0f01e4dd4014
MD5 hash:	655a8d08e37cfdad20c2e563eabb8957
humanhash:	lemon-pluto-finch-hamper
File name:	Quotation. [RFQ 28042026].exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	946'688 bytes
First seen:	2026-05-05 13:24:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'930 x AgentTesla, 19'824 x Formbook, 12'310 x SnakeKeylogger)
ssdeep	24576:Fq3CcqzzTa0jpZcf+YFdy9f2lTAAi+7G3hNkJRYkB:0izO08GYgf2lTAALy3hNkJ
Threatray	57 similar samples on MalwareBazaar
TLSH	T1441523AC5F28C652E8D547B81B72E77903B92F8EB023C3598FDABDDBB8372100615591
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	threatcat_ch
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

155

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f86e5b12-7797-4b7f-9be6-b82bb0f8e756/

Malware family:

agenttesla

ID:

File name:

Quotation.RFQ28042026.exe

Verdict:

Malicious activity

Analysis date:

2026-05-05 08:53:34 UTC

Tags:

auto-reg stealer evasion agenttesla

Link:

https://app.any.run/tasks/eb573fe2-a8d6-4295-b6ac-84221be43fe5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/64579/

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Launching a service

Changing a file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-05T03:06:00Z UTC

Last seen:

2026-05-07T10:56:00Z UTC

Hits:

~1000

Detections:

Trojan.Win32.Vimditator.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb PDM:Trojan.Win32.Generic Trojan-Spy.Stealer.FTP.C&C Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agent.sb Trojan-PSW.Agensla.TCP.C&C HEUR:Trojan-Spy.MSIL.Agent.sb Trojan.MSIL.Dnoper.sb VHO:Backdoor.Win32.Androm.gen Trojan.Win32.Agent.sb Trojan-PSW.MSIL.Agensla.g Trojan-Dropper.Win32.Injector.sb HEUR:Trojan-PSW.MSIL.Agensla.gen Backdoor.Win32.Androm.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.MSIL.Agensla.sb Exploit.Agent.FTP.C&C

Link:

https://opentip.kaspersky.com/c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/ad862112-46bc-4b63-82c2-73af71f72be4

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1908749

Signature

.NET source code contains potential unpacker

AI detected malicious Powershell script

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Creates an autostart registry key pointing to binary in C:\Windows

Creates autostart registry keys with suspicious values (likely registry only malware)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.24 Win 32 Exe x86

Link:

https://app.malva.re/file/655a8d08e37cfdad20c2e563eabb8957

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c/

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c

Threat name:

ByteCode-MSIL.Trojan.SnakeKeylogge

Status:

Malicious

First seen:

2026-05-05 08:53:43 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

15 of 23 (65.22%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yogosqcarspmhnqkadjtfg2nhlf3foab5taxhwycg2wyunnyvjwa._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

8b012d3d775bd32f503cb84a6889d786c06623eeb8c840bd8c03073971530f52

AgentTesla

c1809985bc96ceb090d1627981130698f934d033f8c45b49d8f07326ff11ab73

AgentTesla

f33b8ab9fca177f47dd8cf23417361f2ac63a0832ad322e32a141a3bc9a08287

AgentTesla

+ 47 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery execution keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/260505-qpbpnacz5m/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

SmartAssembly .NET packer

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Family: AgentTesla

Unpacked files

SH256 hash:

c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c

MD5 hash:

655a8d08e37cfdad20c2e563eabb8957

SHA1 hash:

761e8d031a2306e7ad862e8a3e1a0f01e4dd4014

Link:

https://www.unpac.me/results/6d225933-fd67-45ee-bf71-0a3e9c5c90f2/

SH256 hash:

50b044fdf6ef68f9c4651f2058b889e7199ed9882342e5fbcb65c0372fc3498b

MD5 hash:

e741b14e6d5b9cb132b29d72e45deba1

SHA1 hash:

4cd3be0545d2cd03bc177e017ebc29b544cc4d2e

Link:

https://www.unpac.me/results/6d225933-fd67-45ee-bf71-0a3e9c5c90f2/

SH256 hash:

5f8f388eb29fcf4176ff0643e385e6ab9ddfd9281dd15c26c523a23027c5acbf

MD5 hash:

546002e70110e6249f84571413326e42

SHA1 hash:

6dd90a6d51d43cd52f8d51ef505f56aef38f8840

Link:

https://www.unpac.me/results/6d225933-fd67-45ee-bf71-0a3e9c5c90f2/

SH256 hash:

2cbe0104d0a55f21c2f0e895a50df2ffdbdebfe2e020c7b5dead6aaeb233467e

MD5 hash:

6e709eef0402edad04464e90fd7b700d

SHA1 hash:

7b78f8a790bcbb4febf73b1dc77abbb4de9ab099

Detections:

win_agent_tesla_g2

triage_agenttesla_infostealer

Link:

https://www.unpac.me/results/6d225933-fd67-45ee-bf71-0a3e9c5c90f2/

Parent samples :

a515fd4ef2d7b5c1d60af04da2e2138036f493ce5d02d1491354560b718f80ce
95f214d4e4b557548f2077ed9ab2f260471326b442a45824db16ec7c58fe0900
8a3fe2533d9c2036dd92b2b437b8d1ca237308d4383cdfb4cf13eadd9012060a
6fc591dec9831bfce04458d407a74f24728019a03ac61a8aa0cbc64791c68d63
ad131f58df2bb784cc7182a2afb12c7dbc9c139bcd881d913eb7776e9b399c02
2cbe0104d0a55f21c2f0e895a50df2ffdbdebfe2e020c7b5dead6aaeb233467e
a23faad998ccfd975f0123b836dd65c158f931f1ea3c01e5415c82a148b08f89
5300e3303b8d3213380216de0de7f3321cac74a6a8e5c7f2d506d3a5db92b42d
c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c
3962e783a7d66e1fcc1a26328c1cb3f9e1af50a1005a447449999d5f5b8bd880
ce3562ba09381cf9931edac0983a7f732b5d1007ea878416fed7fb3a9958cb8d

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c38ce940408c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV2 Create hunting rule
Author:	ditekshen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	MALWARE_Win_AgentTeslaV2 Create hunting rule
Author:	ditekSHen
Description:	AgenetTesla Type 2 Keylogger payload

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe c38ce940408c9ec3b60a00d3329b4d3acbb2b801ecc173db0236ad8a35b8aa6c

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/64579/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample