MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca284de89072e35f499624e288e7c520ebbf62977f2714b5924b70ff0cace55e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ca284de89072e35f499624e288e7c520ebbf62977f2714b5924b70ff0cace55e
SHA3-384 hash:	665f408c1c75001422e2eef15ee215774a1e662f0f5044db7d924bf1d8596393f438ec9463450f1f13d54e04b3604054
SHA1 hash:	dd888799f9c77914119316974c893713c6d76c39
MD5 hash:	96a125bfccbd411212a93d60b5c889b5
humanhash:	bluebird-moon-hamper-fourteen
File name:	nCopy_of_Shipping_docs.z
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	615'403 bytes
First seen:	2025-12-23 07:01:37 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	12288:itQHZ4b48Mt/eQWYP9LO5RGttMmg5Yq2rkdGikDn1YzMSwKZ1tRIOTj9vC:WQHtt/dWyLMsttc5YTQwikD1cK21tbj4
TLSH	T114D4235E40318260447B5757A22DD7A8651CCF802C3B61B35DB80D266EAF7C6CFABEB4
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	FXOLabs
Tags:	AgentTesla z

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

43

Origin country :

BR

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3cc6241d-2922-41f6-af58-63a0945e0021/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=694a3e7aa6c88bb4cc23dd09

Tags:

autoit emotet

Hybrid Analysis Mal/DrodRar

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/ca284de89072e35f499624e288e7c520ebbf62977f2714b5924b70ff0cace55e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2025-12-23T03:47:00Z UTC

Last seen:

2025-12-25T05:03:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/ca284de89072e35f499624e288e7c520ebbf62977f2714b5924b70ff0cace55e/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca284de89072e35f499624e288e7c520ebbf62977f2714b5924b70ff0cace55e/

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/ca284de89072e35f499624e288e7c520ebbf62977f2714b5924b70ff0cace55e

ReversingLabs TitaniumCloud Win32.Spyware.Negasteal

Threat name:

Win32.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-23 07:02:19 UTC

File Type:

Binary (Archive)

Extracted files:

28

AV detection:

19 of 24 (79.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ziue32eqolrv6smwetrirz6fedv36yuxp4trjnmsjnyp6dfm4vpa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ca284de89072e35f499624e288e7c520ebbf62977f2714b5924b70ff0cace55e