MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 18

Intelligence 18 IOCs YARA 9 File information Comments

SHA256 hash:	f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
SHA3-384 hash:	3833a8b598db8f5c4644990cfaa2cc76e5a79eb5941d0e1e1abaf7cb359f45b72f0be587c10f25c21450bf10afd68cf4
SHA1 hash:	4f3bdc880c4e49b5e1ca16589a8d35a7d71e05d8
MD5 hash:	26a5a451023dbe4e8c2d4b7c10f77e14
humanhash:	fanta-eleven-avocado-equal
File name:	f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	694'272 bytes
First seen:	2025-12-08 15:53:41 UTC
Last seen:	2026-01-09 15:11:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	21371b611d91188d602926b15db6bd48 (79 x Formbook, 65 x AgentTesla, 34 x SnakeKeylogger)
ssdeep	12288:Bz7hU5I5yuNHIgzSFKxWltRohBfSTso93UbScmPr8LKocxPkOzWRrOHr1f:Bf+iN57Gtene3AGWxc5koWROH5f
TLSH	T123E423865AE16850C4A0A370C833CC5459793872DE19776E8729F1BFAC303A7EA5FB1D
TrID	39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'698 x Formbook, 1'203 x CredentialFlusher, 928 x AgentTesla)
Reporter	adrian__luca
Tags:	AgentTesla exe UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	694'272 bytes
File size (de-compressed) :	1'201'152 bytes
Format:	win32/pe
Unpacked file:	fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt PEPacker

Details

AutoIt

extracted scripts and files

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/9c2aec25-fb5d-4986-94cf-092dd2603bda/

Malware family:

n/a

ID:

File name:

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641

Verdict:

No threats detected

Analysis date:

2025-12-09 04:28:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/df5046f0-59d9-49bf-8d4b-a0c5ff8cdee1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/43730/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6936f4fedb58e1a2c22b9aa5

Tags:

negasteal autoit virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching a process

Using the Windows Management Instrumentation requests

Reading critical registry keys

Launching a service

Changing a file

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

autoit compiled-script microsoft_visual_cc overlay packed packed packed upx

Link:

https://www.filescan.io/uploads/6936f4b3ff25e40750d7bd95/reports/e2aa60b1-0d11-4919-9607-b877e5e5b279/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-26T00:41:00Z UTC

Last seen:

2025-11-28T06:36:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641/results?tab=lookup

Gathering data

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/26a5a451023dbe4e8c2d4b7c10f77e14

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-11-26 04:25:48 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

29 of 38 (76.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=637na52uhdhu5dfkvje4rlsvzp7zxfv5ejhxgxtnedn33iwoizaq._file

Verdict:

malicious

Label(s):

unc_loader_001

agenttesla

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan upx

Link:

https://tria.ge/reports/251208-tce34azlcn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/baa2d398-d649-48bf-b20f-b610c404caf9

Unpacked files

SH256 hash:

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641

MD5 hash:

26a5a451023dbe4e8c2d4b7c10f77e14

SHA1 hash:

4f3bdc880c4e49b5e1ca16589a8d35a7d71e05d8

Link:

https://www.unpac.me/results/8e10174f-9d9a-484a-a631-8c16747e4f9b/

SH256 hash:

fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

MD5 hash:

d1cac8fb7a112aebf2c8c44914646a07

SHA1 hash:

293d86892ddec1db5c8ea6fbb3243d817b54e051

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/8e10174f-9d9a-484a-a631-8c16747e4f9b/

Parent samples :

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

SH256 hash:

c684bbb8caf4359c9d7c598e3c5b8a20363bb0347eaf9c989b95e418ec3bce5e

MD5 hash:

4d924fd00d8de66069d7c17a657b105d

SHA1 hash:

3e8d1ba00a07e4f204442c4d414a3027beec09a4

Detections:

win_samsam_auto

SUSP_OBF_NET_Reactor_Native_Stub_Jan24

MAL_Malware_Imphash_Mar23_1

MetaStealer_NET_Reactor_packer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/8e10174f-9d9a-484a-a631-8c16747e4f9b/

Parent samples :

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

SH256 hash:

708bd9715efa1b50fd524690be30152520d317903633fabdf1f65d4309bb5288

MD5 hash:

d6634f7a37fff6a6a00a95e87b2edba1

SHA1 hash:

647307855b8c4bacf415425fd4bee351e78638c7

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

RedLine_Campaign_June2021

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/8e10174f-9d9a-484a-a631-8c16747e4f9b/

Parent samples :

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

SH256 hash:

bfadc806807d2354d0a04db9b72918fca8d4f22a21b724a321dcab576d7775be

MD5 hash:

c714bda197e494fabe681cfe920d7d2b

SHA1 hash:

da1a9e4379a05089978d5737ff93dfd67de891f4

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/8e10174f-9d9a-484a-a631-8c16747e4f9b/

Parent samples :

f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641
fd29bc834973da689e30a5386df77b77b16e845da6bbae5c0e2d9ea8d2da9706

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f6fed0775438/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f6fed0775438cf4e8caaaa49c8ae55cbff9b96bd224f735e6d20dbbda2ce4641

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator