MALICIOUS — bf010ff289595d56a2299a613058b675e794af18b70d3505bc7b16c9b22f9f0d.bin

MALICIOUS — bf010ff289595d56a2299a613058b675e794af18b70d3505bc7b16c9b22f9f0d.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AgentTesla family. 5 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: bf010ff289595d56a2299a613058b675e794af18b70d3505bc7b16c9b22f9f0d
• SHA-1: 3841f2034c379281cb52fcabb1b4a930cbc873a4
• MD5: 9e1bed1767db43ebfcafa62aa4fb46fb
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• File type: pe · Size: 1139712 bytes
• Verdict: malicious (100/100) · Family: AgentTesla

Source: MalShare · first seen 2026-08-05T16:09:17.753Z · SHA-256 verified

Detections (5 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV feed: SaneSecurity foxhole_generic: Porcupine.Malware.58887.UNOFFICIAL
• Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Agensla.gen
• Microsoft Defender: Trojan:MSIL/PureLogStealer.ABTG!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Yogi.43344

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Dynamic analysis (windows)

35244 behavior events · 2 ATT&CK techniques · 27 dropped files.

Runtime network

• www.msftconnecttest.com
• inference.location.live.net
• ip-api.com
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• licensing.mp.microsoft.com
• assets.msn.com
• www.bing.com
• tas02.sls.update.microsoft.com
• fe3cr.delivery.mp.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/13591/files/9429fb123c90f8d5130515bc7f73b0157a5bc3c6a7558f336c80cc2680b9dca2 — 9429fb123c90f8d5130515bc7f73b0157a5bc3c6a7558f336c80cc2680b9dca2
• /opt/CAPEv2/storage/analyses/13591/files/96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 — 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
• /opt/CAPEv2/storage/analyses/13591/files/5007f6955fbb531c024efe7b64238d74422e76bd59db230282e01a3903a53b44 — 5007f6955fbb531c024efe7b64238d74422e76bd59db230282e01a3903a53b44
• 0b78b1cc3cdc05e64d811fad72dc1148910f5d76c5899fdbf1a7061b33e131cb — 0b78b1cc3cdc05e64d811fad72dc1148910f5d76c5899fdbf1a7061b33e131cb
• 74554a0c1603fd968812c170a1ca824c237ffd2a7ed61c91bc5614d55da04341 — 74554a0c1603fd968812c170a1ca824c237ffd2a7ed61c91bc5614d55da04341
• e54a097d1b1eca041830578a922417c1e023f6b2c3c7c8a2e17c00c2719ccbe6 — e54a097d1b1eca041830578a922417c1e023f6b2c3c7c8a2e17c00c2719ccbe6
• de6fcd0057618919da51ad05ea0c17df63867f908bd6f94f36a8291b78e37181 — de6fcd0057618919da51ad05ea0c17df63867f908bd6f94f36a8291b78e37181
• c70c332ab5d78875640bf44356105405f663c19792961e72c007d29c75cd3439 — c70c332ab5d78875640bf44356105405f663c19792961e72c007d29c75cd3439
• e9bfcdf98c49127aa626e23f2fcf65c30dbf374f1d4a18de1e87e6ea627ce979 — e9bfcdf98c49127aa626e23f2fcf65c30dbf374f1d4a18de1e87e6ea627ce979
• 67a3dd94b3c82617ad148ce570865123fbf8a2b7d0df73afbc4e976ef02f0b62 — 67a3dd94b3c82617ad148ce570865123fbf8a2b7d0df73afbc4e976ef02f0b62
• 562b4b7e2ef4367ade92818fe7b3875a2a7258a95cd1ddc47242c971ad920eb9 — 562b4b7e2ef4367ade92818fe7b3875a2a7258a95cd1ddc47242c971ad920eb9
• 7672ecef65b42c747fb9fac99f2281637fb92bd4f7adb43b02198c4c2ad56e55 — 7672ecef65b42c747fb9fac99f2281637fb92bd4f7adb43b02198c4c2ad56e55
• f16d2c1d859bc96e4ec48367d399cd825cdbe85c98401fc9140c4c3fae2a9b82 — f16d2c1d859bc96e4ec48367d399cd825cdbe85c98401fc9140c4c3fae2a9b82
• 697fd2dccd50ff7036f9e1849542a435847e20adda2d5dc5c1c48891a2481dcd — 697fd2dccd50ff7036f9e1849542a435847e20adda2d5dc5c1c48891a2481dcd
• 4eb01bcc9a2251b5105282122d19f1c96938f7e7fb642cde737e9ab08782467e — 4eb01bcc9a2251b5105282122d19f1c96938f7e7fb642cde737e9ab08782467e

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786551734&P2=404&P3=2&P4=DrygwRWPMD1%2b1p5RQBz2ZS%2fgT1zIyYiwRuLadPpW2reSc5YKxhkL6r5XsMZYtbq5puwpjoTq6fjyz8R%2fb%2bsGww%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786551774&P2=404&P3=2&P4=lvCxHjQxHDHy6XySJDNCEGtSLZ3QcoSMsCH1woykvdxxpOE825c445zsONzxrh8RvIShVGemxGZ3lbZwEe0rvA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://ip-api.com/line/?fields=hosting

Embedded domains

• ip-api.com

Embedded IP addresses

• 4.150.223.103
• 52.123.252.225
• 52.230.60.54
• 4.247.188.224
• 4.230.171.124
• 57.154.63.210
• 74.178.240.61
• 135.233.95.135
• 51.104.15.253
• 4.150.223.104
• 135.234.160.246
• 52.123.252.216
• 74.178.232.29
• 52.123.252.213
• 203.26.79.13
• 40.79.150.123
• 135.233.45.222
• 52.110.12.14
• 52.110.12.45
• 72.145.35.114
• 52.148.114.188
• 92.223.78.30
• 52.110.12.50
• 45.125.247.123

File paths

• E:\&F
• m:\1xm

More AgentTesla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report