MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 805963dc775b0107e60e83570e05ca7ef4f1c47b5537f850bd65819ff0d75667. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 805963dc775b0107e60e83570e05ca7ef4f1c47b5537f850bd65819ff0d75667
SHA3-384 hash: 2350f79e1ac1b31f96307eba61c1ee6d8ccff499e276e78b09a4b6f5d5a5779f3417fc81d313a35676f96eb1293b7ef1
SHA1 hash: 8f0e3072d89ef18ee6897b430e4b9827bc83bbe4
MD5 hash: a0dfa6fc78e98aa7dfc4a3260d980f79
humanhash: four-march-kentucky-spaghetti
File name:FreeTempSpoofer.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'817'806 bytes
First seen:2025-10-17 12:57:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
Note:This file is a password protected archive. The password is: 123
ssdeep 49152:v88HAS7pn8CqZG0cFDELulBId9xpqVRdM:04Awh8CJplUS29sM
TLSH T171853374C634D012157A4E39672ED5260268FC7A04AF77D8F7209D3EBC94CD68AF4B8A
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter burger
Tags:DCRat pw-123 rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
NL NL
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:dControl.rar
File size:455'514 bytes
SHA256 hash: 1c52dd820b66e3f5307b6b59ef0fcd46600d40cd7a3d86a8d181d59431d6c0ef
MD5 hash: d1371ea489a7276525b153c600edbc63
MIME type:application/x-rar
Signature AgentTesla
File name:blockdriv.rar
File size:427 bytes
SHA256 hash: d9e15fde6e53232440a87199d5cf3dbce1892f6bb8adf8468afeea27bff6cd1e
MD5 hash: 40901f10f77409cd454e4c2e4b545222
MIME type:application/x-rar
Signature AgentTesla
File name:RankupServiceFreeTempV5.exe
File size:2'032'576 bytes
SHA256 hash: e97d951d16cf830c8ac014afb27c6b09736527ef963c2eb973f95c2f4bbeadc4
MD5 hash: 62eec3fac213ab732e4756bb5c3eb9c6
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e66de0277c2bd8bc5de577
Tags:
applicunwnt injection extens
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/805963dc775b0107e60e83570e05ca7ef4f1c47b5537f850bd65819ff0d75667
Verdict:
Unknown
File Type:
rar
Link:
https://opentip.kaspersky.com/805963dc775b0107e60e83570e05ca7ef4f1c47b5537f850bd65819ff0d75667/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Rar Archive
Link:
https://app.malva.re/file/a0dfa6fc78e98aa7dfc4a3260d980f79
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/805963dc775b0107e60e83570e05ca7ef4f1c47b5537f850bd65819ff0d75667/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-10-17 12:58:38 UTC
File Type:
Binary (Archive)
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qbmwhxdxlmaqpzqoqnlq4bokp32pdrd3ku37quf5mwaz74gxkztq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/805963dc775b0107e60e83570e05ca7ef4f1c47b5537f850bd65819ff0d75667

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Any_SU_Domain
Create hunting rule
Author:you
Description:Detect any reference to .su domains or subdomains
Rule name:Check_VBox_Guest_Additions
Create hunting rule
Rule name:Check_VmTools
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_Enigma
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Enigma
Rule name:MALWARE_Win_DLAgent10
Create hunting rule
Author:ditekSHen
Description:Detects known downloader agent
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:win32_dotnet_form_obfuscate
Create hunting rule
Author:Reedus0
Description:Rule for detecting .NET form obfuscate malware
Rule name:win32_dotnet_loader
Create hunting rule
Author:Reedus0
Description:Rule for detecting .NET loader malware
Rule name:Windows_Generic_MalCert_65514fe0
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

AgentTesla

rar 805963dc775b0107e60e83570e05ca7ef4f1c47b5537f850bd65819ff0d75667

(this sample)

AsyncRAT

Executable exe aa5c7d69d06c6fe831464fe03e9ad4e58fb0e49f0c70b1b56741db2fd758154e

AgentTesla

Executable exe e97d951d16cf830c8ac014afb27c6b09736527ef963c2eb973f95c2f4bbeadc4

  
Dropping
SHA256 e97d951d16cf830c8ac014afb27c6b09736527ef963c2eb973f95c2f4bbeadc4
  
Dropping
MD5 62eec3fac213ab732e4756bb5c3eb9c6

Comments