MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 20

Intelligence 20 IOCs YARA 10 File information Comments

SHA256 hash:	ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab
SHA3-384 hash:	9765a55834930429641fec58fcb95f6fae9fb14169d9f398ebfdaf8dad5f4624b8b9c7f2449b3d3d6bc056f06bf48896
SHA1 hash:	c0e8483dc4eba9ffd82ec89b5d838e2545bbee67
MD5 hash:	abb587c7cab32c2a9e23903c25ec8312
humanhash:	twelve-minnesota-beryllium-romeo
File name:	PO_ASQT2510153810.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	693'248 bytes
First seen:	2025-12-02 08:47:51 UTC
Last seen:	2025-12-08 11:48:54 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	21371b611d91188d602926b15db6bd48 (77 x Formbook, 64 x AgentTesla, 32 x SnakeKeylogger)
ssdeep	12288:nz7hU5I5yuNHIgzSFKxWltRohBfSTso93UbhikILSgtAHopQlKJc4Ky:nf+iN57Gtene3AQnSMT
Threatray	1'189 similar samples on MalwareBazaar
TLSH	T18FE423555BC89D60D61473308832CD605AB4BC319E01773ECB3AE9ABAD343D7E922B9D
TrID	39.1% (.EXE) UPX compressed Win32 Executable (27066/9/6) 38.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 7.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.9% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'644 x Formbook, 1'203 x CredentialFlusher, 911 x AgentTesla)
Reporter	adrian__luca
Tags:	AgentTesla exe UPX

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	693'248 bytes
File size (de-compressed) :	1'200'128 bytes
Format:	win32/pe
Unpacked file:	112699f3eed96b2dfb176b880f3be86ea083431600aeb889cd3ef46607caf4f2

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

AutoIt PEPacker

Details

AutoIt

extracted scripts and files

PEPacker

a UPX version number and an unpacked binary

Link:

https://research.acce.ciphertechsolutions.com/results/155eb052-7989-486a-a877-899f68a79b9f/

Malware family:

agenttesla

ID:

File name:

_ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab.exe

Verdict:

Malicious activity

Analysis date:

2025-12-02 08:55:13 UTC

Tags:

stealer ultravnc rmm-tool agenttesla netreactor

Link:

https://app.any.run/tasks/cccef8b6-34c1-4ac1-b7cc-fb90a5a76bf6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/42134/

Detection(s):

Win.Trojan.Autoit-10037269-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692ea80916e6db515e45e636

Tags:

emotet lien

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

autoit compiled-script microsoft_visual_cc overlay packed packed packed stealer upx

Link:

https://www.filescan.io/uploads/692ea82767d69113a45822d8/reports/94b9a4ed-25f5-4c57-ab5c-36f2e1f320f1/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-27T02:23:00Z UTC

Last seen:

2025-12-04T05:24:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.MSIL.Agensla.d VHO:Trojan-PSW.MSIL.Agensla.acms Trojan-Spy.Agent.SMTP.C&C Trojan-PSW.Agensla.TCP.C&C HEUR:Trojan.Win32.Generic Trojan.Win32.Strab.sb Trojan.Win32.Inject.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agensla.sb Trojan-PSW.MSIL.Agensla.g Trojan-PSW.MSIL.Agensla.acms Trojan.Win32.Zenpak.sb HEUR:Trojan-PSW.MSIL.Agensla.a Trojan-PSW.MSIL.Agensla.acmo Trojan.Win32.Auzenpak.sb Trojan.MSIL.Crypt.sb Trojan-PSW.Win32.Stealer.sb

Link:

https://opentip.kaspersky.com/ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3b2257f6-ed2f-4c74-a146-cfbeb754d759

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab

Verdict:

Malware

YARA:

5 match(es)

Tags:

AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86

Link:

https://app.malva.re/file/abb587c7cab32c2a9e23903c25ec8312

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab/

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-11-27 12:07:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 37 (64.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=74ynes3ffyv5izyjzcz4b64mfeyxei22ajka25ewz4putbh6mkvq._file

Verdict:

malicious

Label(s):

unc_loader_001

agenttesla

AgentTesla

231241bf7085015077370cd69dc1c85aa0c3ade473b6c41506c55242d2fbd1e9

AgentTesla

5f5a466793a001e84271e4ead05ddaf9c42f1496bb14d984ad63669258c12913

AgentTesla

88a82a5314a34297b8dcbc4107ba97f2573fbfb73dbf484bba974078308245fb

AgentTesla

90934a7223298d694ec80a01da6b1f869e399db5d6bdea8d87db2473c76142a3

AgentTesla

faf7837d6f3eab407b7555232f4e8a779e8f2ecc49a72a46354dd802b2479bdf

AgentTesla

fea78e68059354dfa41c1613756952165aac02aec20e0c4f84f9081edd94a901

AgentTesla

+ 1'179 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan upx

Link:

https://tria.ge/reports/251202-kqrvdasqem/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

UPX packed file

AgentTesla

Agenttesla family

Verdict:

Malicious

Tags:

Win.Trojan.Autoit-10037269-0

YARA:

n/a

Link:

https://app.threat.zone/submission/f494be70-fdf0-4370-bd01-7ef7b764b065

Unpacked files

SH256 hash:

ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab

MD5 hash:

abb587c7cab32c2a9e23903c25ec8312

SHA1 hash:

c0e8483dc4eba9ffd82ec89b5d838e2545bbee67

Link:

https://www.unpac.me/results/de9e39cf-7582-4a35-886e-deb23964f5d3/

SH256 hash:

112699f3eed96b2dfb176b880f3be86ea083431600aeb889cd3ef46607caf4f2

MD5 hash:

b7faf6deed94ed572cd0b893ebd043d5

SHA1 hash:

35b8c513f6dc2aed43a69e3032d1bffcddda0ece

Detections:

AutoIT_Compiled

Link:

https://www.unpac.me/results/de9e39cf-7582-4a35-886e-deb23964f5d3/

Parent samples :

ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab
112699f3eed96b2dfb176b880f3be86ea083431600aeb889cd3ef46607caf4f2

SH256 hash:

5f136c5bcbe1b77a29a2378d9b61f494c7ef017d35b165fe8bfccd5b2365af6f

MD5 hash:

f181d2b9d9d79b301b6183412632aa6c

SHA1 hash:

1768fc7c77c03f637060b5b8cbb59f245b73d463

Detections:

win_samsam_auto

SUSP_OBF_NET_Reactor_Native_Stub_Jan24

MAL_Malware_Imphash_Mar23_1

MetaStealer_NET_Reactor_packer

MALWARE_Win_RedLine

Link:

https://www.unpac.me/results/de9e39cf-7582-4a35-886e-deb23964f5d3/

Parent samples :

ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab
112699f3eed96b2dfb176b880f3be86ea083431600aeb889cd3ef46607caf4f2

SH256 hash:

85ee8c358af74aaf6d0c3265ba5eb33c41c7094864ad1adde3fc979d4752bd10

MD5 hash:

c1ec0eadc7e033f2f576fc01044ea85a

SHA1 hash:

1d0d176348e6c76de1514e59ca18992f638323be

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

RedLine_Campaign_June2021

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/de9e39cf-7582-4a35-886e-deb23964f5d3/

Parent samples :

ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab
112699f3eed96b2dfb176b880f3be86ea083431600aeb889cd3ef46607caf4f2

SH256 hash:

00ad5964f9f76b5b5447024dbc288187444bfa2ffcd5eeb5f7bd55e41201b02e

MD5 hash:

a6a4f79fbad086ccb06fcbe2507af979

SHA1 hash:

81023b2ebb86b7c31ed6fdbda85a14b5485791e3

Detections:

AgentTesla

SUSP_OBF_NET_Reactor_Indicators_Jan24

Agenttesla_type2

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Link:

https://www.unpac.me/results/de9e39cf-7582-4a35-886e-deb23964f5d3/

Parent samples :

ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab
112699f3eed96b2dfb176b880f3be86ea083431600aeb889cd3ef46607caf4f2

Malware family:

RedNet

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ff30d24b652e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ff30d24b652e2bd46709c8b3c0fb8c293172235a02540d7496cf1f4984fe62ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator