MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 17

Intelligence 17 IOCs YARA 5 File information Comments

SHA256 hash:	f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820
SHA3-384 hash:	e5cdbc1ef0f7cef50d5779249c04f0a3d90419df595ce894e4b02012c1dcbffa14d2e89bafd7f10252f1fc174534d2fb
SHA1 hash:	a5c0f3b258a0f3e530219eec85b5ab8b11a56fea
MD5 hash:	8a1a126d7b607a8947ec2ff09a323a87
humanhash:	minnesota-batman-minnesota-sweet
File name:	dekont_2738827362826236623.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	728'064 bytes
First seen:	2025-06-04 06:57:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:9J2GHYXhyq59rE/8PFjCKkLeHiauuGgR70CM/zfJe7bfCtuh98XsLhp5D:9JV4RyqTrtFjC+0uqJ/Lo7bfC8AXsFb
Threatray	3'354 similar samples on MalwareBazaar
TLSH	T175F4E00436B98B97C9B917F82962D17087F96D9DA431E31A4EC26ECF75B1F000652F87
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	abuse_ch
Tags:	AgentTesla exe geo TUR

Intelligence

File Origin

# of uploads :

# of downloads :

459

Origin country :

Vendor Threat Intelligence

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/7207/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=683fef4d8bd5d68a12e4e4ea

Tags:

spawn shell virus lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Adding an exclusion to Microsoft Defender

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/683fee8e171e01f959357785/reports/53a8435d-a67a-4aaa-8c13-71e31d0b5ab9/overview

Verdict:

Malicious

Labled as:

Genie.8DN.Generic

Link:

https://www.hybrid-analysis.com/sample/f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9a4c860a-0f08-4ef4-bb42-86e9ca697d70

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1705609

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses threadpools to delay analysis

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820/

Threat name:

Win32.Trojan.SnakeLogger

Status:

Malicious

First seen:

2025-06-03 07:46:43 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

31 of 38 (81.58%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6sjoz2v3rqenjnmvtj4zit26krcmun7qwzxite7ou4psryttdaqa._file

Verdict:

malicious

Label(s):

agenttesla

unc_loader_037

AgentTesla

a32812ea87167fe0a9275823f6c873984de4dc7ece43895f02a175826aeecdce

AgentTesla

aba4d6ba306deaf02c3122060facf7e11d19da806321ac993c42461d4e9edcd7

AgentTesla

b858cc21f6276c7518a9c7f1fc92d2ae8f432ace4359744dbcf92e0ddeffa3ed

AgentTesla

cbaf21eca02826ae4c3a6b7e4771a0d35b95e68faca9da32ba9dc0206e6ad174

AgentTesla

cfe3100ff8dfe286be11b889ec8ca0a14211d56651469114ee5f440d8ff3e5a6

AgentTesla

e9faca7e44847bde376839999ff7491a3ffb0409f47e170560a64fa878ebdb55

AgentTesla

fa54825b8b94917037cc1620eb21421f9bd31ac394f396c1fe80546e4ed88dfa

AgentTesla

+ 3'344 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250604-hrns1asnv5/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

external_ip_lookup

YARA:

n/a

Link:

https://app.threat.zone/submission/188353a5-3e7f-4b43-9499-8c193ac7b168

Unpacked files

SH256 hash:

a1f8cf040654382c09ef356987efafc0c54204b51ba83d5700a319ea7fff16d2

MD5 hash:

d72810c4d4fb7d2b4e5dc0e65a486e96

SHA1 hash:

45fa6559ebc803c26f9a76e07e422cd675b652ff

Detections:

win_agent_tesla_g2

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

MALWARE_Win_AgentTeslaV2

Link:

https://www.unpac.me/results/0693b683-1252-4c1c-87ba-b1e93488aec2/

Parent samples :

43a1d69c1f2d0c38298be7068a959e67dd980973eee15a1f143f15dadbb5b573
a6efa39536c28ce7c13801e1dd750d1e2a355a9fbf5b6f8ec234df50d8e93927
dc3c5b7993046434bbbe259da9c49a95022e7c3a32bd859485dc47217f57fe4f
f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820
f0b9b0fcc5688be094fe596b2c69681a8e37206d82e551844d7dbcb6c6118d84
954f2ac805cd070d9d4d977244ae59b5aaae05a2264ad301b067825af10eb026
363fbee865f233393dcf42844f0a85fbe41fbdba7e02e9f8491149f7f416af50
bdee1f00bac8c820656feaa0a14878285a46cddff586e81080b1eb3f0672d622
2da821a16a58013374b1c28c7d36bd06e6a9e7afc3897e55c0c33da6bbc4f66d

SH256 hash:

e9d20f8140e200a7b4b580b12c90b5408fe029b3e96938eb6ac8402702e0b7b1

MD5 hash:

d771fbf4bf55593f9efe8a87142722c6

SHA1 hash:

5cb2aaf12053cd64c4cda99232d32d6f5f6a6490

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/0693b683-1252-4c1c-87ba-b1e93488aec2/

Parent samples :

c5cda31ca3369da6d1aa062f41c8cca45a7ec066b62a71750745d5789cc5c198
f986713ff94bda45de1cd7edfc20df66d718ce76fecaeebab1aa8d237761fcd9
f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820

SH256 hash:

73dfb6aa0dfca825d78d029138d1ef0108ce086e95c5c81bdb36cb2cf3d9870d

MD5 hash:

30642ab3093cb65aaa7ec393060c4c96

SHA1 hash:

97764937fe0209320f852687732dc3eddb805674

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/0693b683-1252-4c1c-87ba-b1e93488aec2/

SH256 hash:

f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820

MD5 hash:

8a1a126d7b607a8947ec2ff09a323a87

SHA1 hash:

a5c0f3b258a0f3e530219eec85b5ab8b11a56fea

Link:

https://www.unpac.me/results/0693b683-1252-4c1c-87ba-b1e93488aec2/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f492eceabb8c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f492eceabb8c08d4b5959a79944f5e5444ca37f0b66e8993eea71f28e2731820

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/7207/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample