MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f
SHA3-384 hash: ff519a6ecce3c0a919b06ec3ca12be3c9390bb7f31134fda6c63ce7d31c92da17a6bc78beed852c1f19446edb0b0c2a1
SHA1 hash: 269b7196f825f13934edeb4a2867ac1f9d8d52af
MD5 hash: 3fb030b9de0b6c682e462e9e60e22e09
humanhash: eight-whiskey-timing-mexico
File name:po48588686969970707978.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:778'720 bytes
First seen:2025-12-11 12:54:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 103 x GuLoader, 64 x DiamondFox)
ssdeep 12288:NgojAMGJ35JzJwGdJzrJqHJUJjJ3JBi6JKJpJPJLOJ0J+JXJ4Jv72JQCJNZgvJHw:Ngo1GJ35JzJwGdJzrJqHJUJjJ3JBi6Jq
TLSH T18DF412A1F105E2AAE9914DB4CA2A8EF247E1FC65C9C85707F284BF1D7CB31724366076
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 09c8d0d2c8c471d9 (1 x AgentTesla)
Reporter Anonymous
Tags:AgentTesla exe ftp-holzbrenzii-com

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
PL PL
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
a c2 URL, a useragent string, and a string XOR key
GuLoader
an XOR decryption key and an extracted component
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/d4deca30-6320-4071-9610-36eb4b4c1155/
Malware family:
guloader
Create hunting rule
ID:
1
File name:
po48588686969970707978.exe
Verdict:
Malicious activity
Analysis date:
2025-12-11 12:56:21 UTC
Tags:
guloader
Link:
https://app.any.run/tasks/c5835e7e-d4f6-450d-8575-7f93b591ecb6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/44283/
Detection(s):
SecuriteInfo.com.Trojan.Loader.1575.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693abf3ca675b653bd10149d
Tags:
injection obfusc virus
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer installer installer-heuristic microsoft_visual_cc nsis overlay phishing signed
Link:
https://www.filescan.io/uploads/693abf3a1eac7b9b76a5c01a/reports/9024b71e-0b49-44b5-8111-679119feb7d0/overview
Verdict:
Malicious
Labled as:
Malware_51.6
Link:
https://www.hybrid-analysis.com/sample/cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-11T03:59:00Z UTC
Last seen:
2025-12-13T11:29:00Z UTC
Hits:
~1000
Detections:
Trojan-Downloader.Win32.Minix.sb Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb Trojan.Makoob.HTTP.C&C HEUR:Trojan.Win32.Makoob.gen Backdoor.Androm.HTTP.Download Trojan.NSIS.Makoob.sba
Link:
https://opentip.kaspersky.com/cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/58548b0f-9a88-4b9f-bc56-b3733ac1eb29
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/3fb030b9de0b6c682e462e9e60e22e09
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zq7ott67qv544jj4n3luahimaknnfqu5j7w2f54vz7ebun5i4b7q._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:guloader discovery downloader execution keylogger persistence ransomware spyware stealer trojan
Link:
https://tria.ge/reports/251211-p5yzfsb13a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Badlisted process makes network request
Looks up external IP address via web service
Loads dropped DLL
AgentTesla
Agenttesla family
Guloader family
Guloader,Cloudeye
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/99f4d535-fb1f-444f-a40d-b585e57bf248
Unpacked files
SH256 hash:
cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f
MD5 hash:
3fb030b9de0b6c682e462e9e60e22e09
SHA1 hash:
269b7196f825f13934edeb4a2867ac1f9d8d52af
Link:
https://www.unpac.me/results/01bf511f-f473-4900-a7fd-f0f4c14b0d64/
SH256 hash:
d5de6937d32e3b6df451bee1fa21e056cab3ece9105ea2ca7522e46dc01d45ca
MD5 hash:
efea9bcaab23000e72cedf0f94f652c6
SHA1 hash:
202dd550d882b0a0cea9ec18e368442e36ffc664
Link:
https://www.unpac.me/results/01bf511f-f473-4900-a7fd-f0f4c14b0d64/
SH256 hash:
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 hash:
6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 hash:
070ea80e2192abc42f358d47b276990b5fa285a9
Link:
https://www.unpac.me/results/01bf511f-f473-4900-a7fd-f0f4c14b0d64/
SH256 hash:
c719697d5ced17d97bbc48662327339ccec7e03f6552aa1d5c248f6fa5f16324
MD5 hash:
ca5bb0ee2b698869c41c087c9854487c
SHA1 hash:
4a8abbb2544f1a9555e57a142a147dfeb40c4ca4
Link:
https://www.unpac.me/results/01bf511f-f473-4900-a7fd-f0f4c14b0d64/
SH256 hash:
c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
MD5 hash:
ec9c99216ef11cdd85965e78bc797d2c
SHA1 hash:
1d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
Link:
https://www.unpac.me/results/01bf511f-f473-4900-a7fd-f0f4c14b0d64/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cc3ee9cfdf85/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc3ee9cfdf857bce253c6ed7401d0c029ad2c29d4feda2f795cfc81a37a8e07f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/44283/

Comments