MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a957865951c7b1f03533017f69f030fd54bddc116ddb90799cdced217a35d11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 11 File information Comments

SHA256 hash:	3a957865951c7b1f03533017f69f030fd54bddc116ddb90799cdced217a35d11
SHA3-384 hash:	28ab3a251474f24c8fe4bcb735a9cd1bfb4f32ee5b2b4daf316f16da787d14a2fddf04bb767838b89876a8531ce67251
SHA1 hash:	5fc34f8a41b110b298ffbdaa9861bc8dbd9765da
MD5 hash:	c43b62c316cb4d5ec14c3752279d3def
humanhash:	hotel-batman-winter-pizza
File name:	Sunprint order.rar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	713'894 bytes
First seen:	2025-12-10 08:16:12 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:TXitmDV69AsPgyeN4ymsy7cJs6Ku334hZ4ngOq2lZcHGzJEngbB7hiiBTYug:LWmRrzmqJsa34cnhlZLJEnmBVLkug
TLSH	T138E4239592CA4714ECF538375B72E6687E9D0D17B8794BB32201540F3B6DD0CB6ACB06
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	AgentTesla rar

cocaman

Malicious email (T1566.001)
From: "import@s-stargroup.com" (likely spoofed)
Received: "from s-stargroup.com (unknown [213.209.157.123]) "
Date: "09 Dec 2025 10:54:27 -0800"
Subject: "NEW PO# AP-907/25 DATED 13.10.25"
Attachment: "Sunprint order.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Sunprint order.exe
File size:	1'242'624 bytes
SHA256 hash:	ea8167c61681db5a133270595a261ea3f0a8f9f2cdb2b8b1b31b9911dcd601ae
MD5 hash:	60e6cd2f8be392d293af69658648b76a
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5b30f903-5b4c-4d58-b90d-25ee132bef9f/

Detection(s):

Sanesecurity.Foxhole.Zip_fn108.UNOFFICIAL

Win.Dropper.Zeus-9996119-0

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69392c8ca675b653bd0fa195

Tags:

autoit emotet lien

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint keylogger masquerade microsoft_visual_cc packed zeus

Link:

https://www.filescan.io/uploads/69392c8a1eac7b9b76a3472b/reports/02139ce0-1608-4d1c-9524-0824d39a08d2/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3a957865951c7b1f03533017f69f030fd54bddc116ddb90799cdced217a35d11

Verdict:

Malicious

File Type:

rar

First seen:

2025-12-09T01:35:00Z UTC

Last seen:

2025-12-12T06:00:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/3a957865951c7b1f03533017f69f030fd54bddc116ddb90799cdced217a35d11/results?tab=lookup

Verdict:

Malware

YARA:

1 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Rar Archive Suspect

Link:

https://app.malva.re/file/c43b62c316cb4d5ec14c3752279d3def

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3a957865951c7b1f03533017f69f030fd54bddc116ddb90799cdced217a35d11/

Threat name:

Win32.Spyware.Negasteal

Status:

Suspicious

First seen:

2025-12-09 07:35:51 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hkkxqzmvdr5r6a2tgal7nhydb7kuxxobc3o3sb4zzxhnef5dluiq._file

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/251210-kny6nsdy5a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3a957865951c7b1f03533017f69f030fd54bddc116ddb90799cdced217a35d11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator