MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d90b69c0f000d5e848d64e4e5bce817dc192906d794bf5903243a7106de3ef65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d90b69c0f000d5e848d64e4e5bce817dc192906d794bf5903243a7106de3ef65
SHA3-384 hash:	ff1fa7b8dd1018c17a48e87be0bf833a9e93c88a4368b38eab94276f4389194fe21fd913821b83dafbf6b2f6e9f78d8c
SHA1 hash:	5a0c5e0b942e5f059e8a9451c7de2c383624b9f5
MD5 hash:	c84e03d3408e2ac69506e96be863a7f4
humanhash:	queen-winter-wolfram-seven
File name:	Order_PSP_112625_ODP.7z
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	4'276 bytes
First seen:	2025-11-27 09:07:29 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	96:iKPqeC3MR8nOpBwJjLgl3muJGmuSUkcUVFFKfu5Np0ZiDG:xyOR8Op2Pa2u1ubGFFsu5kZiDG
TLSH	T1FA913B5DEC066F2DE332E5F35A8929343D5202FD6DA29B57B53AE887E940544B827007
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	juroots
Tags:	7z AgentTesla

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

IL

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Order_PSP_112625_ODP.js
File size:	6'577'816 bytes
SHA256 hash:	2cb24bafbd5728a17a8a8d07a555061ad58a81a25ce3dc090c5d3ca4c8a77349
MD5 hash:	e0534f7d1896913a959c38ee5d8c20a8
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.GT.JS.ObfPadding.1.4BFEDA04.30755.17516.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6928152c6cb1dcd577817801

Tags:

n/a

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d90b69c0f000d5e848d64e4e5bce817dc192906d794bf5903243a7106de3ef65

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

7z

First seen:

2025-11-26T12:24:00Z UTC

Last seen:

2025-11-26T12:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d90b69c0f000d5e848d64e4e5bce817dc192906d794bf5903243a7106de3ef65/results?tab=lookup

Nucleon Malprob Benign

Score:

9%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/d90b69c0f000d5e848d64e4e5bce817dc192906d794bf5903243a7106de3ef65

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

7z Archive SFX 7z

Link:

https://app.malva.re/file/c84e03d3408e2ac69506e96be863a7f4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d90b69c0f000d5e848d64e4e5bce817dc192906d794bf5903243a7106de3ef65/

ReversingLabs TitaniumCloud Script-JS.Trojan.ObfPadding

Threat name:

Script-JS.Trojan.ObfPadding

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-26 12:37:21 UTC

AV detection:

7 of 38 (18.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3efwtqhqadk6qsgwjzhfxtubpxazfednpff7lebsiotra3pd55sq._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/251127-k4z3xatpc1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://archive.org/download/msi-pro-with-b-64_20251125/MSI_PRO_with_b64.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d90b69c0f000d5e848d64e4e5bce817dc192906d794bf5903243a7106de3ef65