MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 18

Intelligence 18 IOCs YARA 21 File information Comments

SHA256 hash:	eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224
SHA3-384 hash:	3e7e76788a8810c5053589de31e176b2c779e8707cf4252b078476509b401f5ef4e9be762f1edd4d23387380c661c09f
SHA1 hash:	077d9ab9d77a79c58cbd2d9e56432d846f0d6c3c
MD5 hash:	fe8e0227c82d61be0b3ccdf294982c68
humanhash:	high-missouri-blue-fish
File name:	rSALESQUOTATION738800124.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	827'392 bytes
First seen:	2025-08-14 04:00:12 UTC
Last seen:	2025-09-05 12:32:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:fB23C6Q5fRHY0rZ3CiYGW4D3qbj3fEpor:f83SRHYQ3CfQ6HEp
TLSH	T14B0501D72605C706CCA97E744CE2E3B9D366DE8DA411C30769E6FEEB393AE40255C182
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10522/11/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
dhash icon	72d0d4e0e4d4f022 (3 x Formbook, 1 x AgentTesla, 1 x SnakeKeylogger)
Reporter	FXOLabs
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

_eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224.exe

Verdict:

Malicious activity

Analysis date:

2025-08-14 04:01:09 UTC

Tags:

stealer ultravnc rmm-tool netreactor agenttesla

Link:

https://app.any.run/tasks/41c2066d-401e-48b4-921d-ef50c3e2d454

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/21260/

Detection(s):

Porcupine.MSIL.Kryptik.AODZ.415921.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689d5f672018ee52f0248926

Tags:

virus lien msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Launching a service

Stealing user critical data

Verdict:

Malicious

Labled as:

Genie.8DN.Generic

Link:

https://www.hybrid-analysis.com/sample/eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e5ccd1a3-89f7-43cf-bf90-7c00b93fb478

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable PDB Path PE (Portable Executable) SOS: 0.30 Win 32 Exe x86

Link:

https://app.malva.re/file/fe8e0227c82d61be0b3ccdf294982c68

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224/

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224

Threat name:

Win32.Trojan.Leonem

Status:

Malicious

First seen:

2025-08-14 03:33:45 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5l5yjnl46y64u655nw27cwqahpboxe3iabe3qo47usyd3tryeisa._file

Verdict:

malicious

Label(s):

unc_loader_037

agenttesla

Similar samples:

error

AgentTesla

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250814-ekxksayjt3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Agenttesla family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/4065dfbc-8ec9-46bd-b1cf-be5ac2b7e612

Unpacked files

SH256 hash:

eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224

MD5 hash:

fe8e0227c82d61be0b3ccdf294982c68

SHA1 hash:

077d9ab9d77a79c58cbd2d9e56432d846f0d6c3c

Link:

https://www.unpac.me/results/d0806e8d-6be0-4660-82e6-ff627b92843e/

SH256 hash:

ae9636466d21decb91b7506adffce283e2652a10b4a54a665f6fe95362401f8e

MD5 hash:

99cbfdf6df98b1f5871eab4e7ad72ce6

SHA1 hash:

1810136683336172ac6c7c253eacf180e3384689

Link:

https://www.unpac.me/results/d0806e8d-6be0-4660-82e6-ff627b92843e/

SH256 hash:

4f9e76a2dcfeb9f3399243bfbb2884718af6ef049e4f91e06147e922eb847797

MD5 hash:

9a65b87dc4c95fe0f6fa4b941930444a

SHA1 hash:

85eb5e28f35a8d565a78347f462c6d3d906f03d6

Detections:

win_agent_tesla_g2

AgentTesla

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Agenttesla_type2

Link:

https://www.unpac.me/results/d0806e8d-6be0-4660-82e6-ff627b92843e/

Parent samples :

58924b2968d04cc20ff58b4d0c4c220f7109eefb13db6b348aa2754293fbfe85
730932451281bdcb34fd32ac3aeaedef8f0a919492032944bffaa5852b85d4a4
b50abf45e0678c75cfc596847eae2d069926ea34c71302a6d2904cfd380669e8
66d9239944d23d3680e32ff7044a29b44ac945379cdca227ba5b51f75d252a53
bec40e9e4bc9018106ccb3da5ebc4714cac1f436e421714cc8d76470ffd6edd6
a91034a005a82a1ec69a6682de74809632207aa47acefe46bf44e98af51284b7
e4097233fec4adb5cb99489005e6beaf15b6f7e7c3040432b11b65e49a9cf55f
15bee5f27c8e807fca30b704600b5f4ffa67a5fa80d51bb444c42d52c9020cef
36870ed67d32b8398243d77c47975603750cc92e9821db555b8e2b2df4d3d3b6
6cfc601fa3fcc2f02606539608dd1f08bfccc8d0ccfc6f32d7bd5110dc0b6f5e
d5a0f85ffb3ee297f57ffb96a77288de2a564c5cb337b5c6c7b01da8e36545d6
f3c4c44285b5439a4c608e38beb95ada32d34f68b83ed9795649185754d9d5bd
76bd7d4ab00c260d021b928207d2617b19784eedfe615c1352419512e62fb8cf
75a62b6fff32b813131d55fde90e5eb52818c3b34304716404d23dab89a90b8d
2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029
50f213324308d7628f1708c4cb7c6242bb15ed45f1828f459703bfd692d007a0
d22ba564b79465fff584d41655b8bd84e6bf0046b30d371cc2ccc5adc08e5a84
d0149e816937c3d187140af8bb91858c5afaca1320c98697a02e2bd890f098a1
eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224
2a8a729d0e203b203a53c0b4ab591ef3aa3eb0fd45972297a2b597404ecef986

SH256 hash:

07199a8cb1db954551795648f1fe47428cb394c94fb84728cdad7c37e047ddd4

MD5 hash:

cc965435766d2d2185834ba7c3248346

SHA1 hash:

cd7f722a6a87b6b6caa96e68e02b7f5a1286f0f1

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/d0806e8d-6be0-4660-82e6-ff627b92843e/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/eafb84b57cf6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	agentesla Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked agenttesla malware samples.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	win32_dotnet_form_obfuscate Create hunting rule
Author:	Reedus0
Description:	Rule for detecting .NET form obfuscate malware

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe eafb84b57cf63dca7bbd6db5f15a003bc2eb93680049b83b9fa4b03dce382224

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/21260/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample