MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 19

Intelligence 19 IOCs YARA 24 File information Comments

SHA256 hash:	fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736
SHA3-384 hash:	60d348e00364b2ca3a12a602c2408a90f6d27de706f6b503e1be75bf2f63e87f1cbfdf7716ee4c0b73f6532820882bf9
SHA1 hash:	c2a626a77084ea368e0d4872427a85afcd0610e1
MD5 hash:	94d2f386d5fdced886f54bd28d88ea9f
humanhash:	fifteen-december-potato-social
File name:	fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'117'184 bytes
First seen:	2026-02-05 09:05:57 UTC
Last seen:	2026-02-05 14:56:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1895460fffad9475fda0c84755ecfee1 (432 x Formbook, 126 x AgentTesla, 62 x a310Logger)
ssdeep	24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXdacKfhRl7uNy:APVt/LZeJbInQRacKrl7
Threatray	3'569 similar samples on MalwareBazaar
TLSH	T14635AE027391C062FFAB91734B5AF6115BBC79260123A62F13981DB9FE701B1563E7A3
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	adrian__luca
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

184

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt

Details

AutoIt

extracted scripts and files

Link:

https://research.acce.ciphertechsolutions.com/results/c64ce492-af09-4215-9c44-0638f8ad2a21/

Malware family:

agenttesla

ID:

File name:

fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736

Verdict:

Malicious activity

Analysis date:

2026-02-05 09:05:04 UTC

Tags:

evasion agenttesla stealer

Link:

https://app.any.run/tasks/d228e307-203a-4673-b38a-b7f2f182471a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/51783/

Detection(s):

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69845d908ce611733c0b2d9b

Tags:

autoit emotet lien

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint fingerprint keylogger lolbin microsoft_visual_cc netsh packed reg

Link:

https://www.filescan.io/uploads/69845d8d930564ff3c8c506c/reports/3a3169c5-5664-496f-b359-876817ffc23c/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-01-07T04:55:00Z UTC

Last seen:

2026-02-05T11:31:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.AUO.gen

Link:

https://opentip.kaspersky.com/fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9c55ac8f-315b-483b-896d-4ac28e23bad3

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736

Verdict:

Malware

YARA:

7 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/94d2f386d5fdced886f54bd28d88ea9f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736/

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736

Threat name:

Win32.Malware.Heuristic

Status:

Malicious

First seen:

2026-01-07 08:54:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 36 (66.67%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=73dagycn6l2vf7akrsfleyteorey37x3nf73txgfhtzfbtcke43a._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

6f8a33a2e0555f0950cc31bcbe33f21a0e4473199856ac8caa8ad256e4c80142

AgentTesla

a8af1d02cb428baefa9f6e832310ebe11a1d71c0bae32d448633c251755b5b8a

AgentTesla

cfb6ef3cd5ea2e93e5ff3bf8b349af9ee47a27a3992d4208f618213296e9a611

AgentTesla

e329a29546eb5d2d57e3c21a1b2753a6ba13e2693894c00a0d44c09c0312a11c

AgentTesla

+ 3'559 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260205-k2xj1acx4h/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

AgentTesla

Agenttesla family

Unpacked files

SH256 hash:

fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736

MD5 hash:

94d2f386d5fdced886f54bd28d88ea9f

SHA1 hash:

c2a626a77084ea368e0d4872427a85afcd0610e1

Link:

https://www.unpac.me/results/f97afc67-fe9b-4484-9abf-a9628fe309f2/

SH256 hash:

f2d89ceff0994e26801546271af0f9fc33e4ccbdac1a5ded457be84f47ae27a4

MD5 hash:

6fbc9fc4773ca288a79cbdeee360f5c8

SHA1 hash:

dd4f8a1f90dd6baff26ef8393c19555da8b4eb95

Detections:

win_agent_tesla_g2

AgentTesla

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/f97afc67-fe9b-4484-9abf-a9628fe309f2/

Parent samples :

8845647f13063072e874ae696d5e149e0b373a22214eea0a397427efec337577
22f831f2195236c5865aa5449d554a289fd30d456444d6aa7b983638f0b253f4
2b0bf362ef44ae6c2cc8a859e93211e1c86b5599e0752039b3e69ba400b84b4c
fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736
40b0ea80b2bb6bfe6f9fe8412d408627882eb69c4f9e860ab8a42f0f8ec5755c
429b83afeba46b5bd59d111035fb113975c88a80ccc3a3ae4ad7ef7e7ac06440

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fec603604df2/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fec603604df2f552fc0a8c8ab2626474498dfefb697fb9dcc53cf250cc4a2736

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	AgentTeslaV5 Create hunting rule
Author:	ClaudioWayne
Description:	AgentTeslaV5 infostealer payload

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/51783/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample