MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8960885b9b1c6856497c3b72689a56540b1bb4a781a360f018fba18dae722b4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	8960885b9b1c6856497c3b72689a56540b1bb4a781a360f018fba18dae722b4e
SHA3-384 hash:	d0254e155847cacea209a5e62deaac2848ebba0b11c3ee73683c667a306235f351307e92c311b50e321b1fa19c47e0da
SHA1 hash:	d95129f90c2441a0c781a06df0528dad96c94a68
MD5 hash:	35a86a41ea59ca3391dff1101de645d0
humanhash:	march-mirror-pluto-lamp
File name:	SHIPPING ORDER 2025-1..tar.001
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'413'120 bytes
First seen:	2025-03-25 19:14:39 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-tar
ssdeep	24576:K1JqGzNKXYYUnWp+GVgtdJnZk458fWkwRARFzFHulyEDGyqSVCF:Aj8YYUWpRVIvnZWg+MQYGyqSVCF
TLSH	T11965AD0BAA6CA8B2DF78933D91150CC991F09C4C22CDB25657B8BD3CC83D6615D1FA6E
TrID	62.9% (.TAR/GTAR) TAR - Tape ARchive (GNU) (17/3) 37.0% (.TAR) TAR - Tape ARchive (file) (10/3)
Magika	tar
Reporter	cocaman
Tags:	001 AgentTesla Shipping tar

cocaman

Malicious email (T1566.001)
From: "=?UTF-8?B?IjA4LuiQpemUgEDkvZXmt7wi?= <nora@anli.cn>" (likely spoofed)
Received: "from anli.cn (unknown [45.137.22.99]) "
Date: "25 Mar 2025 12:11:50 -0700"
Subject: "URGENT: NEW DEMAND MATERIAL IMP # 015/25"
Attachment: "SHIPPING ORDER 2025-1..tar.001"

Intelligence

File Origin

# of uploads :

# of downloads :

103

Origin country :

Vendor Threat Intelligence

Detection(s):

Win.Malware.Noon-9829285-0

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e30097cb6d38a89f3e1382

Tags:

injection autorun obfusc micro

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expired-cert explorer invalid-signature lolbin masquerade obfuscated obfuscated packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/67e300d3f274bf2d8e212e91/reports/dbc7f084-df8c-4294-9fd6-a65a83ca6895/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8960885b9b1c6856497c3b72689a56540b1bb4a781a360f018fba18dae722b4e

Result

Verdict:

MALICIOUS

Score:

94%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)