MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 16

Intelligence 16 IOCs YARA 30 File information Comments

SHA256 hash:	fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2
SHA3-384 hash:	72000bed65089a50435d207552194fc4347d8b51226fc423f5dd5bff95ec8f10d35c3996761fedc0082876f8534837dc
SHA1 hash:	42bd3c9d29609df1ca7d70632cffe13c4e7b77d7
MD5 hash:	4d00eed69a01f762ae8c8c149f6b3f38
humanhash:	texas-king-sixteen-aspen
File name:	TK_107297915100_ 3HZ2502-2(ROLL 304-NO1)_SXXK_GREEN STREAM.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	3'028'480 bytes
First seen:	2025-06-30 10:25:33 UTC
Last seen:	2025-07-01 07:10:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	49152:tp7q4d6tl2pMedWjIUmyC/2aGg4t8CPG36reVMBwNfRZQU8lCE/vDMoydg:t1q4wtl6IIVsgXCPG33+B6fxIvvD
Threatray	3'883 similar samples on MalwareBazaar
TLSH	T1ABE58E092331EE16DD42A335BAB747092B53E13852C2921B931DFB35EBDA2C72F91593
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	lowmal3
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

750

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

TK_107297915100_ 3HZ2502-2(ROLL 304-NO1)_SXXK_GREEN STREAM.exe

Verdict:

Malicious activity

Analysis date:

2025-06-30 10:33:40 UTC

Tags:

auto-startup evasion stealer purecrypter susp-powershell netreactor ultravnc rmm-tool exfiltration smtp agenttesla

Link:

https://app.any.run/tasks/90f84f87-d5dc-41b9-bdec-6dbef7a9e13c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/11627/

Detection(s):

Win.Trojan.EmbeddedDotNetBinary-9940868-0

Win.Trojan.EmbeddedReversedDLL-9940922-0

Win.Trojan.Generic-10014419-0

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6862104e0fceda814b4724fe

Tags:

vmdetect autorun

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Creating a file in the %AppData% directory

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Sending a custom TCP request

Creating a window

Stealing user critical data

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Trojan.Mardom.MN.Generic

Link:

https://www.hybrid-analysis.com/sample/fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/567d35e0-f00e-4525-90a4-f6869db058f7

Result

Threat name:

AgentTesla, ResolverRAT

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1725422

Signature

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops VBS files to the startup folder

Encrypted powershell cmdline option found

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Drops script at startup location

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Yara detected ResolverRAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/4d00eed69a01f762ae8c8c149f6b3f38

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2025-06-30 01:39:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 36 (61.11%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7vwp7tuurl7zyfytjjwstnn2o4romwt3hbnl54dpwnl42kzswhra._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

7563a0a6af2b6ac9a3f89c1ba505e624b782c3a33455d34943bf3ad2fec4e853

AgentTesla

9868233efd40db7ca4ca8a74ba02b87ff7af25cc812a4656ffd36c50d4f9e919

AgentTesla

b7268f9814ddac66d6a4c1c43115d19de4fdb23e4d30ae233aeb51127213a1df

AgentTesla

e3fe04a6924263fc3b589b9d1d5dab4970a1f3b0de25400090c4e6ad7682c2f0

AgentTesla

e4eccfbdbb3828e99d1218f4a91d0cda1c0a9329dac7f9aea5262d022efc00aa

AgentTesla

error

AgentTesla

fbfb02eb54f7233dfa93999f807625d84c345f469a7231ff0a866afc92d1bf37

AgentTesla

fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2

AgentTesla

+ 3'873 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250630-nr6ayazmz6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Drops startup file

AgentTesla

Agenttesla family

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/0fa8c34c-439d-4aee-9ea5-4d429bef5020

Unpacked files

SH256 hash:

fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2

MD5 hash:

4d00eed69a01f762ae8c8c149f6b3f38

SHA1 hash:

42bd3c9d29609df1ca7d70632cffe13c4e7b77d7

Link:

https://www.unpac.me/results/53d234c4-b650-46bf-8bdd-22289bc1d953/

SH256 hash:

8ee17cfb932596c3ee7139a5e10227a6fd64273d402424372c6f91365d9b7a50

MD5 hash:

d3a2dcf8aef63d62537f78b822ff52bc

SHA1 hash:

83916c4afc9213f4ce44f295604713ff0aaa20af

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/53d234c4-b650-46bf-8bdd-22289bc1d953/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fd6cffce948a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	agentesla Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked agenttesla malware samples.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	reverse_http Create hunting rule
Author:	CD_R0M_
Description:	Identify strings with http reversed (ptth)

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Typical_Malware_String_Transforms Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Typical_Malware_String_Transforms_RID3473 Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/11627/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample