MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8994e7911577f27c5bec419466fc98399a75f6f09664d45eab1fca1b8868382. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8994e7911577f27c5bec419466fc98399a75f6f09664d45eab1fca1b8868382
SHA3-384 hash: b51800cc5b6a72963b7dcab2cf1d33dadfe54085efa5b4030c281eabc492f14b19ae1276c4327edeafa05a0c2cf430ae
SHA1 hash: 2774da224265a6294369ca1d7de0f9ca6320fa0e
MD5 hash: c33c13a65d5ee4a99d6bb0c4fc1761ec
humanhash: leopard-sierra-jersey-echo
File name:New Order 568330.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:877'305 bytes
First seen:2025-09-12 18:16:45 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 24576:Nts2y4jS6A6fwQ5d7wNpspJk2OXl20kD8c2uBxIu2jfdI02k3O:ns74jv/wQ5dsfoIlkD8c2PuYdN2k3O
TLSH T1B815333472E8CB6C235CA99DA0F47832894E79494AF7D91646A387BE173051C9ECBC73
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika sevenzip
Reporter cocaman
Tags:7z AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: "Gagliano, daniele<daniele.gagliano@az-armaturen.de>" (likely spoofed)
Received: "from az-armaturen.de (unknown [5.252.153.125]) "
Date: "12 Sep 2025 11:15:47 -0700"
Subject: "New Order 568330"
Attachment: "New Order 568330.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:New Order 568330.exe
File size:880'128 bytes
SHA256 hash: 3ea4c86fddc6402af2ac84907483d90ca72c42455e1c9216d089148f89d864cc
MD5 hash: 7361b2f1a2a73f0e6bbb31a03d38bba3
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c464e8d49ea3f1e4b4c108
Tags:
obfuscate autorun xtreme spawn
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/c8994e7911577f27c5bec419466fc98399a75f6f09664d45eab1fca1b8868382/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 masquerade packed phishing
Link:
https://www.filescan.io/uploads/68c463f10d1238ff0aab061e/reports/68f88ce5-c3f9-4af8-a206-e0d07199d82e/overview
Verdict:
Malicious
Labled as:
Trojan.Win64.Kryptik
Link:
https://www.hybrid-analysis.com/sample/c8994e7911577f27c5bec419466fc98399a75f6f09664d45eab1fca1b8868382
Verdict:
Malicious
File Type:
7z
First seen:
2025-09-12T07:18:00Z UTC
Last seen:
2025-09-12T07:18:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c8994e7911577f27c5bec419466fc98399a75f6f09664d45eab1fca1b8868382/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/c8994e7911577f27c5bec419466fc98399a75f6f09664d45eab1fca1b8868382
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
.Net 7z Archive Executable Managed .NET PE (Portable Executable) PE File Layout SFX 7z SOS: 0.66
Link:
https://app.malva.re/file/c33c13a65d5ee4a99d6bb0c4fc1761ec
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8994e7911577f27c5bec419466fc98399a75f6f09664d45eab1fca1b8868382/
Threat name:
Win64.Spyware.Negasteal
Create hunting rule
Status:
Suspicious
First seen:
2025-09-12 12:45:56 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 24 (70.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zcmu46irk57sprn6yqmum36jqom2ox3pbfte2rpkwh6kdoegqoba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z c8994e7911577f27c5bec419466fc98399a75f6f09664d45eab1fca1b8868382

(this sample)

AgentTesla

Executable exe 3ea4c86fddc6402af2ac84907483d90ca72c42455e1c9216d089148f89d864cc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ea4c86fddc6402af2ac84907483d90ca72c42455e1c9216d089148f89d864cc
  
Dropping
MD5 7361b2f1a2a73f0e6bbb31a03d38bba3

Comments