MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d107a41f1f3441da2b55718efc6b19d5e956c6c2e2240bd9b9e4bdf3e9d68b3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d107a41f1f3441da2b55718efc6b19d5e956c6c2e2240bd9b9e4bdf3e9d68b3a
SHA3-384 hash:	fc24721a1b6c28e7842dc92e751ea93aef3ba89e8b6fb1594b03beeeb07f1afc28a8f27c4bc23f21ebcd906e304cfaa3
SHA1 hash:	41fb20e441cb208f768da55dd98f7b5b4d054251
MD5 hash:	f3bd834edae655e800dc1ef484e735f4
humanhash:	texas-ten-pip-nitrogen
File name:	PO_240390.rar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	19'883 bytes
First seen:	2026-10-14 15:12:29 UTC
Last seen:	2026-10-14 15:13:01 UTC
File type:	rar
MIME type:	application/vnd.rar
ssdeep	384:mE6JzUn9F74um42cM7b9Yj0+rPTZJingVlAZ1IaWBOVDaxmRJHdJGKQdqw/8nNVa:x6FU97PZ0CDbZ42AKaWQ0shdJeLC0
TLSH	T1BF92D1012C0060FB1B76516DBDB1CAEFE63AFA3A22E90978230DFB5CC460D595DB9894
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	AgentTesla rar

Intelligence

---

File Origin

# of uploads :

8

# of downloads :

42

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	PO 240390.js
File size:	303'848 bytes
SHA256 hash:	d473c08f9941f9d951aa6756db30d70565a3038eabdc952c899cf37a151306aa
MD5 hash:	021782ae7aa444d7906d090fd6f3c590
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/51f40a52-0ca2-4e74-a9c4-8cf46e8e3bc9/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.77397251.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac6be3ac221a7c081080b26

Tags:

shell virus sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

agenttesla repaired

Link:

https://www.filescan.io/uploads/6acf9c213467caad9948b1b0/reports/07eab668-011f-472d-b653-a70e53afd586/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/d107a41f1f3441da2b55718efc6b19d5e956c6c2e2240bd9b9e4bdf3e9d68b3a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-08-30T20:21:00Z UTC

Last seen:

2026-10-05T02:46:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/d107a41f1f3441da2b55718efc6b19d5e956c6c2e2240bd9b9e4bdf3e9d68b3a/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/f3bd834edae655e800dc1ef484e735f4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d107a41f1f3441da2b55718efc6b19d5e956c6c2e2240bd9b9e4bdf3e9d68b3a/

ReversingLabs TitaniumCloud Script-JS.Trojan.AgentTesla

Threat name:

Script-JS.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-31 01:56:54 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

15 of 36 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2ed2ihy7gra5uk2voghpy2yz2xuvnrwc4isaxwnz4s67h2owrm5a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261014-s3ygpaxthx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Reads the TCP/IP host and domain name from the registry

Command and Scripting Interpreter: PowerShell

Network Service Discovery

Badlisted process makes network request

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://munihuacho.gob.pe//sifyWeb/MSI_PRO.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/d107a41f1f3441da2b55718efc6b19d5e956c6c2e2240bd9b9e4bdf3e9d68b3a