MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91d07daa5487e90ade300c1c8d037086fa9ba5cc0972fe1a114cd223bf244214. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	91d07daa5487e90ade300c1c8d037086fa9ba5cc0972fe1a114cd223bf244214
SHA3-384 hash:	2cfffafae78f5418e6af3bd66a0fd8fa78b0e24102c1f8db123588c65151ab7607ac5618f84557dc7c58d38263678956
SHA1 hash:	6a8cd9c7b2f24720e82d7f415eb042e6a84a93a6
MD5 hash:	7b66e9ccdb5f71eed3c604165b5f8362
humanhash:	oranges-massachusetts-nebraska-idaho
File name:	CAPITAT SC 2025-2..tar.001
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'413'120 bytes
First seen:	2025-03-25 19:14:04 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-tar
ssdeep	24576:E1JqGzNKXYYUnWp+GVgtdJnZk458fWkwRARFzFHulyEDGyqSVCF:6j8YYUWpRVIvnZWg+MQYGyqSVCF
TLSH	T16E65AD0BAA6CA8B2DF78933D91150CC991F09C4C22CDB25657B8BD3CC83D6615D1FA6E
TrID	62.9% (.TAR/GTAR) TAR - Tape ARchive (GNU) (17/3) 37.0% (.TAR) TAR - Tape ARchive (file) (10/3)
Magika	tar
Reporter	cocaman
Tags:	001 AgentTesla tar

cocaman

Malicious email (T1566.001)
From: "=?UTF-8?B?IjA4LuiQpemUgEDkvZXmt7wi?= <nora@anli.cn>" (likely spoofed)
Received: "from anli.cn (unknown [45.137.22.99]) "
Date: "25 Mar 2025 12:11:50 -0700"
Subject: "URGENT: NEW DEMAND MATERIAL IMP # 015/25"
Attachment: "CAPITAT SC 2025-2..tar.001"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Win.Malware.Noon-9829285-0

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e30097cb6d38a89f3e1382

Tags:

injection autorun obfusc micro

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expired-cert explorer invalid-signature lolbin obfuscated obfuscated packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/67e30091f274bf2d8e212e14/reports/bb427134-ed6d-4e8d-8364-9f55fc3e1666/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/91d07daa5487e90ade300c1c8d037086fa9ba5cc0972fe1a114cd223bf244214

Result

Verdict:

MALICIOUS

Score:

94%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)