MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 610f7c97d7b4f1e296881bef6a71563f29de081c5dfd5b043b5a072310756f17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	610f7c97d7b4f1e296881bef6a71563f29de081c5dfd5b043b5a072310756f17
SHA3-384 hash:	35f983fe6db4d1e2fd195990b3d02de9d5035e89d4e3c2309919d9b802c27079ce58c8de6b59b220a76f74f0d81c0992
SHA1 hash:	4107035d63d60b41feee31b153a488282baf5de3
MD5 hash:	57ae6dbd92471ed82c58f18164ffbea4
humanhash:	william-neptune-burger-hamper
File name:	PO_6544972345 (1).uue
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	624'812 bytes
First seen:	2025-04-12 06:39:52 UTC
Last seen:	2025-04-12 09:05:48 UTC
File type:	uue
MIME type:	application/x-rar
ssdeep	12288:O2j7wEiOtV3Ca/ECHQ2ab/QPUHe6/5ifTggbWqbyw3Hs/YO9ORqJEb/d:5j75b33HNH247w5ifTgtq25/Y54JG
TLSH	T1BDD423B278CFC96AE9E14EC8D5227E671DCB0D4D10AD925DD6D2100B4F94FE62AA0C98
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	AgentTesla uue

cocaman

Malicious email (T1566.001)
From: "manowar.ch <no-reply@manowar.ch>" (likely spoofed)
Received: "from manowar.ch (unknown [195.211.191.231]) "
Date: "12 Apr 2025 02:04:49 -0700"
Subject: "cPanel notification manowar.ch"
Attachment: "PO_6544972345 (1).uue"

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f4b652e011fe619facf417

Tags:

virus micro lien msil

Verdict:

Malicious

Labled as:

Trojan.Agent

Link:

https://www.hybrid-analysis.com/sample/610f7c97d7b4f1e296881bef6a71563f29de081c5dfd5b043b5a072310756f17

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/610f7c97d7b4f1e296881bef6a71563f29de081c5dfd5b043b5a072310756f17/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2025-04-08 06:11:37 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mehxzf6xwty6ffuidpxwu4kwh4u54ca4lx6vwbb3lidsgedvn4lq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/610f7c97d7b4f1e296881bef6a71563f29de081c5dfd5b043b5a072310756f17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)