MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 19


Intelligence 19 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9
SHA3-384 hash: 31481758fe5f82278c3797f1f63a2a8a9b2828a41ecab77651a3e0d8129e690e87fe5064ede35871fe67b1f9254baeea
SHA1 hash: b720d53e5f18a0fb79a2cfcaf5be0a66f76442d2
MD5 hash: cfc49a196fb3fe0192235141b8de038e
humanhash: item-mango-dakota-football
File name:Packing List&Bill of lading.PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'029'632 bytes
First seen:2025-11-24 14:21:19 UTC
Last seen:2025-11-25 13:33:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:rdZZzdCJvkYzllNkPbdb9tV2CJ7xS92JIuF4:rvZzdizzjepb96eJr
Threatray 227 similar samples on MalwareBazaar
TLSH T11925DF2823E85A18F5FF1B39287415140BF1FC26DA32DA2E6E9650DE0EA5F80DD61737
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter Anonymous
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
122
Origin country :
PL PL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
Packing List&Bill of lading.PDF.exe
Verdict:
Malicious activity
Analysis date:
2025-11-24 14:23:51 UTC
Tags:
netreactor stealer phishing evasion agenttesla ftp exfiltration
Link:
https://app.any.run/tasks/ec1532a8-d534-4e8d-ae91-62a3cb782010

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/41280/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69246a45587b4206e7f2758f
Tags:
micro virus remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypt masquerade obfuscated obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/692469e0deea95d50b2572f7/reports/615d6b6f-44c6-4731-982f-19d3110bedce/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-24T08:16:00Z UTC
Last seen:
2025-11-26T12:21:00Z UTC
Hits:
~1000
Detections:
Trojan-Spy.Stealer.FTP.C&C PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Stealer.sb Trojan-PSW.MSIL.Agent.sb Trojan.MSIL.Inject.c Trojan.MSIL.Inject.b HEUR:Trojan-Spy.MSIL.Agent.sb VHO:Trojan-Spy.MSIL.Noon.gen UDS:DangerousObject.Multi.Generic Trojan-PSW.Agensla.TCP.C&C Trojan-PSW.Win32.Disco.sb Trojan-PSW.MSIL.Agensla.g Trojan-PSW.MSIL.Agensla.sb Trojan.Win32.Agent.sb Trojan-PSW.MSIL.Agensla.d Trojan.MSIL.Miner.sb Trojan.MSIL.Inject.sb HEUR:Trojan-Spy.MSIL.Noon.gen
Link:
https://opentip.kaspersky.com/3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/34537a17-32c2-425e-bb73-5007db07ef11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/cfc49a196fb3fe0192235141b8de038e
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-24 11:11:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=htzcfggvcu4ojq355glgi7aiknu3s5qdqhxioyrfrf7kk3fajg4q._file
Verdict:
malicious
Label(s):
purecrypter
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
53864e83655e52a17e3a9d3e588193218299055f930b470c134e606138426ca5
AgentTesla
938d90bf1bb3fcb3c7352990f0c05603b0208bee21b6e3d02b5f0cab97f7f35d
AgentTesla
d6be3636790bf843b8ea28594aaf894861e5beb00d53ef17480981149d7009c2
AgentTesla
d6fc5f9611c4d44858277a1c792ef65f864b0933a5abd3ed0d209714a8be6aaa
AgentTesla
d98a372deb31439799f2cfdf7a8a0421d71d8c6dc9a2144ba7bcc6894c14f5b2
AgentTesla
+ 217 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/251124-rppf7afp9y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
.NET Reactor proctector
AgentTesla
Agenttesla family
Verdict:
Malicious
Tags:
AgentTesla
YARA:
n/a
Link:
https://app.threat.zone/submission/5475e311-f729-4564-b9ab-962771082376
Unpacked files
SH256 hash:
3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9
MD5 hash:
cfc49a196fb3fe0192235141b8de038e
SHA1 hash:
b720d53e5f18a0fb79a2cfcaf5be0a66f76442d2
Link:
https://www.unpac.me/results/64ae1799-36a3-4e8c-b002-a0bda3768af2/
SH256 hash:
7d1cc6c6774669872f14a75de73e3e785ef6d063a0c4c817d147e2078d77a61a
MD5 hash:
8445f7f856e34e9303600d717579a6c6
SHA1 hash:
28a54b1d1f14812e3c5fe68cf779c9117c098091
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/64ae1799-36a3-4e8c-b002-a0bda3768af2/
Parent samples :
3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9
326b0eb2cdd03a3ab23d83774222769245b2bbe689ba22856273f4fa119b3054
c87c4280f8b9c6bf09c0ac878f0f5d0b1ffaf1cf0627acecd0585e79f5d4b2eb
e344fe526e15e7a798d965e12fa66bbae99c620e2bac85cea2cf39da91e1c2a9
cdefe4487062cf4feeee912c4842224c9f9ee066574205d31efa87aee71f2073
f73987513db8c06902182a46cd5d43b8d1fbcc8cb167b0b3c7ad45b6f482b64c
SH256 hash:
222b04688d1e2030192b188f099ecfd52bd7af6b986ac93e141a80f2766da879
MD5 hash:
c71e17acab65a4dd054c78c0481c7674
SHA1 hash:
63b0d563f15ab5b92c337ef37d741004623d0f62
Link:
https://www.unpac.me/results/64ae1799-36a3-4e8c-b002-a0bda3768af2/
SH256 hash:
79cc6be9565d933e06d1ddd4fb19f4a308f194832a1971e81e33d5de69e960cf
MD5 hash:
0acc9fb80d8371b9171532b967a50156
SHA1 hash:
b182e89c14a7d1aaf76a121af06be803577dc09a
Detections:
win_agent_tesla_g2
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/64ae1799-36a3-4e8c-b002-a0bda3768af2/
Parent samples :
43761bfbd402151a82fb11d83dd01309080ce8d010df228fe65fedc2aa831b97
7e41a89cc3189d021b07d2c2cdcfbf151f498447e73b3539be37bbfa24586fbe
0ba2594f18a9877a39107eb2b0b900686ec92a34979b276d3c53a68c9b220f25
ff58b3aaea6828a067ab0fea61998e92e0b54f310e22992a84fdcd7f87e93f88
3cf22298d51538e4c37de996647c085369b9760381ee876225897ea56ca049b9
SH256 hash:
2673d470353413edfb567ff7479395dc52824db6469520ebe8d91dbca2bccac2
MD5 hash:
e5be1fdba36d5032726313afe4c7dd63
SHA1 hash:
c65ebe77906cec3bcb5e805a327f1aa823be57ca
Link:
https://www.unpac.me/results/64ae1799-36a3-4e8c-b002-a0bda3768af2/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3cf22298d515/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/41280/

Comments