MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9
SHA3-384 hash: dad02083d782ed6703bdefaeed1c3d4251d048753a0a0f6afd550c1a8bb160b7846608aaf3d561b498d9a515f7be466d
SHA1 hash: f5ec3568a805962913fc8d74ff00bfe8b7cc1246
MD5 hash: 080e33b6579f04b3fcac2718e4d77c5a
humanhash: cold-georgia-louisiana-september
File name:Ordine_100078670008860000052.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:956'928 bytes
First seen:2025-11-05 06:33:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:bnUAK2q5b9XjilseLYBhXrMeT7e7yIw9LNg9ZunLPKstytYyn37lrzdlqLPHTVH8:jU/2ges9re7lw9Wr8SB7lXvqzRHKt
Threatray 434 similar samples on MalwareBazaar
TLSH T13115122A5AC64817C66C8A77C07151285370DCABA143E3EE5DC867F4BDF3B6ACE53092
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter JAMESWT_WT
Tags:AgentTesla exe ftp-carbognin-it Spam-ITA

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
Ordine_100078670008860000052.exe
Verdict:
Malicious activity
Analysis date:
2025-11-05 06:35:11 UTC
Tags:
darktortilla stealer ultravnc rmm-tool agenttesla ftp exfiltration
Link:
https://app.any.run/tasks/a858ed47-cece-44d6-9635-124adfeaec25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/35394/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.75.14834.14731.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690aefd89942f1282ecc37ab
Tags:
virus smtp remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-07-23T05:18:00Z UTC
Last seen:
2025-11-06T18:20:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac70fa0a-93a1-4212-9f47-41cfd68717f0
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.63 Win 32 Exe x86
Link:
https://app.malva.re/file/080e33b6579f04b3fcac2718e4d77c5a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9/
Threat name:
ByteCode-MSIL.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2024-07-23 10:36:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tq5nfsnqqg7rvji5issebqs722ee6cg5rklfmjo6rubrefz4kh4q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
53864e83655e52a17e3a9d3e588193218299055f930b470c134e606138426ca5
AgentTesla
5496c8de0d154dbedf97dd0b4c5c854f827c2c84a5d1320378506b421d9df90b
AgentTesla
938d90bf1bb3fcb3c7352990f0c05603b0208bee21b6e3d02b5f0cab97f7f35d
AgentTesla
9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9
AgentTesla
d6be3636790bf843b8ea28594aaf894861e5beb00d53ef17480981149d7009c2
AgentTesla
d98a372deb31439799f2cfdf7a8a0421d71d8c6dc9a2144ba7bcc6894c14f5b2
AgentTesla
error
AgentTesla
+ 424 additional samples on MalwareBazaar
Result
Malware family:
darktortilla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:darktortilla crypter discovery keylogger loader spyware stealer trojan
Link:
https://tria.ge/reports/251105-hblzgaymdt/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Agenttesla family
Darktortilla
Darktortilla family
Detects Darktortilla crypter.
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b7a87399-d4b9-4988-8448-9fbedbcef9d5
Unpacked files
SH256 hash:
9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9
MD5 hash:
080e33b6579f04b3fcac2718e4d77c5a
SHA1 hash:
f5ec3568a805962913fc8d74ff00bfe8b7cc1246
Link:
https://www.unpac.me/results/07199eaa-d18e-4436-a4fc-1bf1ef64ec04/
SH256 hash:
b68d95fde2344d3e3dead9c685c9ce71ca15e15b518dc6140cb111e49375759d
MD5 hash:
fa42f22d54a0ecc102dbf0f1a4f672ce
SHA1 hash:
43d8deb8d4fc65e750566c7db6ec86f90832300c
Detections:
Agenttesla_type2
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
MALWARE_Win_AgentTeslaV2
Create hunting rule
Link:
https://www.unpac.me/results/07199eaa-d18e-4436-a4fc-1bf1ef64ec04/
Parent samples :
8b9937b1b0d041935b1bbca78da475df5b00857ae8d8879580fb03b1e4e5fe0c
220c8a8c3ef3bef73c24d52b293672b920f2dbee9b44bdaf2df6613e005e4ab5
4a01321185b7af7f5cb43fae4af1c155a1a855f3dde9d3f431934845ae38ff00
318b1a12e86afdb422eb91b85e92ec28fbfbd708956725ead1043bc7643b35a6
9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9
SH256 hash:
2db82e9b91b1ccb1957b4e06ec49bfb0096e973213fc1786de1bbe3162f5df5a
MD5 hash:
27dea42a70bd7e948f1171ce873878a1
SHA1 hash:
b87051d51479c093cdf3e721acea4fd8b940b1e5
Link:
https://www.unpac.me/results/07199eaa-d18e-4436-a4fc-1bf1ef64ec04/
SH256 hash:
0781f74db6c9ff7aa0c1e76dd0ebc4a9575fba6caca9aac9fb0131c5a73c84be
MD5 hash:
2c064163cda2f093cf6d20302481dff7
SHA1 hash:
cf948b10d999c369ef51972f86278a4f536d400d
Link:
https://www.unpac.me/results/07199eaa-d18e-4436-a4fc-1bf1ef64ec04/
SH256 hash:
56aaa2b9e53d69dd75c8d1247220d8ea97b1b7705796b2e2ddff34c7eea8adee
MD5 hash:
50f28d178452b2db4e1f466904e55c78
SHA1 hash:
d9a3246a570715d756a6c653b6818afb99ae39ec
Link:
https://www.unpac.me/results/07199eaa-d18e-4436-a4fc-1bf1ef64ec04/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c3ad2c9b081bf1aa51d44a440c25fd6884f08dd8a965625de8d0312173c51f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/35394/

Comments