MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 746a63b3f2e78894f091daafeb21eb6d90ed2bbbcc8779837f670c0dbaac8b02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	746a63b3f2e78894f091daafeb21eb6d90ed2bbbcc8779837f670c0dbaac8b02
SHA3-384 hash:	4a82e800f9c0e452729e2e74acf958037515e6152461fd22affadace85356ae778ac974facc93042b0f49fdaab8fff93
SHA1 hash:	6d94ce25b75cb47ecd3ab6ab6d059065f55c5ba7
MD5 hash:	5a915d94f34fff74c288d42f37043fdf
humanhash:	sink-hamper-helium-massachusetts
File name:	P Order � - PO232825.7z
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	952'996 bytes
First seen:	2025-04-25 13:20:34 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	24576:ZsFlVVtYj19gPrTvcioKaOnOpi9knKYcfLfah3:ZKdtc1aDX3a9p1nKo3
TLSH	T182153305BF7ED9155AAFEBC8E3D3CD6CA3357D6011B19B91618143B8CE48A43AD8CA1C
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	cocaman
Tags:	7z AgentTesla

cocaman

Malicious email (T1566.001)
From: "y8 <y8@jjcaixing.com>" (likely spoofed)
Received: "from jjcaixing.com (unknown [91.199.160.28]) "
Date: "25 Apr 2025 06:19:10 -0700"
Subject: "=?UTF-8?B?Rlc6IFAgT3JkZXIgwqkgLSBQTzIzMjgyNQ==?="
Attachment: "P Order � - PO232825.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	P Order © - PO232825.com
File size:	997'376 bytes
SHA256 hash:	5d856e0c5e6d8fb975a560cdf70b90cbb4c1ce0786aa646316e9c7c63645a564
MD5 hash:	e00f20757f065db1b7d1c246c8747bdb
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Win.Packed.Msilheracles-10017859-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680b8d1ca37ff28e1299aeff

Tags:

obfuscate autorun xtreme shell

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250425-s5cyrsvxbs/

Behaviour

Gathers network information

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Drops startup file

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.92

Link:

https://yomi.yoroi.company/submissions/746a63b3f2e78894f091daafeb21eb6d90ed2bbbcc8779837f670c0dbaac8b02

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_SmartAssembly Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with SmartAssembly

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)