MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 021a99195d12288c6d6f5a9b68c15412cdecad1bc0a816c02df592acfa1002c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	021a99195d12288c6d6f5a9b68c15412cdecad1bc0a816c02df592acfa1002c1
SHA3-384 hash:	2630ba8e07fd8b7de5e8914b06409fb7c57819aa56ff66bc9539818be59da3db1fe5eeae015d11b6b5048c23c71101a0
SHA1 hash:	200692bfb71b1a9bbe108ac773036382bf642159
MD5 hash:	a600f4b1f5374f743d9a533ea6a8ad20
humanhash:	kitten-connecticut-cold-south
File name:	FATTURA_3637872.tar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'147'894 bytes
First seen:	2026-06-30 09:37:40 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-rar
ssdeep	24576:RtX7jFEMe/tzn7E+kS423uyL1mneNIUrjLYEt1xCGYwXM/snnMr:LX7jFETtzn7EFST3uJneZHLYELxcwXMp
TLSH	T193353325B0E9006A1E18CE3326A9538222DD9EDF9F6F6799C8BF384DF1F18C1D4D8525
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	JAMESWT_WT
Tags:	AgentTesla ftp-altatsradgez-com Spam-ITA tar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

92

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	FATTURA_3637872.JS
File size:	3'344'854 bytes
SHA256 hash:	dcf7ed2060ce90a77769f58b443ae6a446c7142265f7518f0e825d4978ee5b59
MD5 hash:	11414348f9a74f84a438e155930f780c
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/adbab81b-438a-4ef0-a8fc-c1adb79fdb3c/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4282811548daf709fb0191

Tags:

spawn lien blic hype

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a438e937c7b07bffec26a47/reports/355bab3d-ebcc-4e90-85c7-454601c19738/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/021a99195d12288c6d6f5a9b68c15412cdecad1bc0a816c02df592acfa1002c1

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-30T06:32:00Z UTC

Last seen:

2026-06-30T08:38:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/021a99195d12288c6d6f5a9b68c15412cdecad1bc0a816c02df592acfa1002c1/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/a600f4b1f5374f743d9a533ea6a8ad20

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/021a99195d12288c6d6f5a9b68c15412cdecad1bc0a816c02df592acfa1002c1/

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/021a99195d12288c6d6f5a9b68c15412cdecad1bc0a816c02df592acfa1002c1

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-30 09:34:57 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ainjsgk5ciuiy3lplknwrqkuclg6zli3ycubnqbn6wjkz6qqalaq._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader adware collection execution keylogger loader persistence spyware stealer trojan

Link:

https://tria.ge/reports/260630-lwg3ssb181/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Enumerates connected drives

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Boot or Logon Autostart Execution: Active Setup

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/021a99195d12288c6d6f5a9b68c15412cdecad1bc0a816c02df592acfa1002c1