MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94d1cd7d7cab17caa0b295e27fee5af703f7c3747c802ab55bc58b2ce56cd2f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 13

Intelligence 13 IOCs YARA 17 File information Comments

SHA256 hash:	94d1cd7d7cab17caa0b295e27fee5af703f7c3747c802ab55bc58b2ce56cd2f7
SHA3-384 hash:	278072e45f81fb301cdbcf1a154699b6994f0201ad15cf1733321698f83d65b8722b1728190c0421fce013a011feb153
SHA1 hash:	0227af4ce1fa50bb3105c2d2a2aff23f70f22f47
MD5 hash:	e5a39ed51d168832f32d48220b6f6dbc
humanhash:	zulu-happy-cardinal-muppet
File name:	25 Ruixing New Order.tar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	715'088 bytes
First seen:	2025-12-09 12:22:13 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:SJ6iEgo82u/b/O4YgdjtdVpweJOKvxVoeXF+MFarojHNyDEq4yvA:SJDERGYstL66OKvNXYMNyDEqfvA
TLSH	T13AE423351ACD5A10474CDFBD23C86CE28949F28F253E14B6B76EBF2F4614B08168796B
Magika	zip
Reporter	cocaman
Tags:	AgentTesla tar zip

cocaman

Malicious email (T1566.001)
From: "=?UTF-8?B?6b6Z5qKB5a6d?= <llb@rmdkj.com>" (likely spoofed)
Received: "from rmdkj.com (216-151-184-245.lon.as62651.net [216.151.184.245]) "
Date: "21 Nov 2025 06:29:42 -0800"
Subject: "25 Ruixing New Order Notice"
Attachment: "25 Ruixing New Order.tar"

Intelligence

File Origin

# of uploads :

# of downloads :

153

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	25 Ruixing New Order.exe
File size:	1'144'320 bytes
SHA256 hash:	a4445ce5e4de1cb6fb8b1edc36bf9e7a3753014e93978db6c4df6bff617e6081
MD5 hash:	df9254ae6077c0764f529e91727aad6d
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d682b9fb-c328-422e-b29f-a3659881e50e/

Detection(s):

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6936ef20881313558a2b936e

Tags:

autoit emotet lien

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/94d1cd7d7cab17caa0b295e27fee5af703f7c3747c802ab55bc58b2ce56cd2f7/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint keylogger masquerade microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/6938147bd12d1c79d42b7416/reports/55847c2c-3d63-43b5-8c5a-a9eee31ccbc6/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/94d1cd7d7cab17caa0b295e27fee5af703f7c3747c802ab55bc58b2ce56cd2f7

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/94d1cd7d7cab17caa0b295e27fee5af703f7c3747c802ab55bc58b2ce56cd2f7

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

File Type:

zip

First seen:

2025-11-21T04:18:00Z UTC

Last seen:

2025-12-03T18:00:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/94d1cd7d7cab17caa0b295e27fee5af703f7c3747c802ab55bc58b2ce56cd2f7/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla discovery keylogger spyware stealer trojan

Link:

https://tria.ge/reports/251209-ptkmpagr71/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

AgentTesla

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/94d1cd7d7cab17caa0b295e27fee5af703f7c3747c802ab55bc58b2ce56cd2f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator