MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
SHA3-384 hash: df137bde823a024ac873db7e8cc957a89c520e137d33e22b7b87c22087a864d9a90cba3567f1c7ecbd23575486209d11
SHA1 hash: fff2dd51ce9c9f108bc56b879f5bab3dbe26c8c8
MD5 hash: 69fdf913a3523081fe549a87dfa8e567
humanhash: foxtrot-mars-mockingbird-ten
File name:f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
Download: download sample
Signature AgentTesla
Create hunting rule
File size:617'984 bytes
First seen:2025-12-08 16:06:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:ow0Z+RX0MEfJKpvStfUSnb9k9BUTjoDS475PSLwjgePnxMTpdo:A8VERKpvSlb9k9BU3oDSwLjgeF
TLSH T1CAD422A04718CF13E8995FB318B0D370A7E85EAE9422D7A743DE8DFBB94B3065814751
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a91f0f92-e7af-450c-b5ef-f87dfdc49f9a/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
Verdict:
Malicious activity
Analysis date:
2025-12-09 06:37:10 UTC
Tags:
stealer ultravnc rmm-tool agenttesla exfiltration auto-sch-xml smtp
Link:
https://app.any.run/tasks/67586ddd-e848-4daa-9da7-41ccd91a29b1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43834/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936f7d2db58e1a2c22b9d98
Tags:
shell virus lien msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Sending a custom TCP request
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a service
Changing a file
Stealing user critical data
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-28T00:41:00Z UTC
Last seen:
2025-12-10T03:45:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451/results?tab=lookup
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.21 Win 32 Exe x86
Link:
https://app.malva.re/file/69fdf913a3523081fe549a87dfa8e567
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-11-28 04:01:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bhqpev7fbuzutqniefoofltbx3kd2q3t7xopibfkq5ealfycriq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
error
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/251208-tj9w2sykay/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c06ea9a3-2ba4-4fd8-af78-cba5ea22c648
Unpacked files
SH256 hash:
f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
MD5 hash:
69fdf913a3523081fe549a87dfa8e567
SHA1 hash:
fff2dd51ce9c9f108bc56b879f5bab3dbe26c8c8
Link:
https://www.unpac.me/results/d10abcc0-4e04-424f-b4aa-e2bf202047de/
SH256 hash:
6aa7e535cd6f31c567adf4da966827d61038bf144d66ab8cabece6fe729968d4
MD5 hash:
512138e0c8f37f2b76725ff62f11f027
SHA1 hash:
1316dcf8967c096f7eebaf0c7d86b488ca3d7f5f
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/d10abcc0-4e04-424f-b4aa-e2bf202047de/
Parent samples :
f7f0d0bcd56c2b929b687aa0c15305be4f71495d0b1ce5609fed155ddb0c016c
a2e39401f7e09438f35e9a4ca0ce24dafbfef8c0b6250170f67fb9a4dfc0b63e
ae91525ecd727e79110dcc98c87e4e30402fbd47f95a2b153e7eda2da97a15fe
f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
e82748853dc0b2c9963cd3725570ea3d8d8329b6a11ba2ac9145006caefaef9e
a3cc9d49257d9c9c8720c29baa025a2b5b35d1857497be67d5d2c09495a62562
SH256 hash:
0ea709318006a7374f5c0af4a5b3837230aa501edadacd41ca3aa0f507f8f724
MD5 hash:
a45ee091b4acacb7cd0544512538b4a5
SHA1 hash:
6b6bad8a19da256c1849cd99150773a2edc31505
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/d10abcc0-4e04-424f-b4aa-e2bf202047de/
SH256 hash:
fa915f22e03c0c0840f7cf8c54adba99e65b52973d30902c760b671fb5b1a583
MD5 hash:
49492e2488ff03eba50e16d4e4c195fc
SHA1 hash:
add8c2778c742629b269f0199af4616a847f7c81
Detections:
win_agent_tesla_g2
Create hunting rule
AgentTesla
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Link:
https://www.unpac.me/results/d10abcc0-4e04-424f-b4aa-e2bf202047de/
Parent samples :
4cbe8505df02aaacfa5ec430b69b2456d4dc27307e6592934a0cc594592852b1
1603ebc35858fe5eb23519fceb18edc6566022ec9d6393a0eb61597fb70e3df2
a0f0473fdc61c805b124ed9b8a2e7dc17a16116118da16b7650f04936c38f184
f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f04f0792bf28/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f04f0792bf28699a4e0d410ae715730df6a1ea1b9feee7a025543a402cb81451

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43834/

Comments