MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd
SHA3-384 hash:	b07095aad7a14703889ba74299bd56622c9e545995d285d48455574eebde98e637e46f00a5d524682f8db6a9406f77a5
SHA1 hash:	9aa6bc76a4a8d2dbf07ff22e07c25957602a6e6e
MD5 hash:	f49e696bffa95238d80fb60a07fcbb59
humanhash:	early-texas-snake-bulldog
File name:	06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'321'762 bytes
First seen:	2026-07-14 09:41:18 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:MBD1mGuJvQdq57MhAdRhWgxgjhMm9mtIJH1mO+PbcOuu9I:MBD1jXUeFgQOuui
Threatray	426 similar samples on MalwareBazaar
TLSH	T12CF55C509428A8B4BD3EC33CE0377FA0465E350B2119EE2E36795658A6D3F472A9D4F3
Magika	javascript
Reporter	JAMESWT_WT
Tags:	AgentTesla ftp-enogcaen-br-com js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

136

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5604c8b3055706bb5530c9

Tags:

virus lien blic hype

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug base64 downloader dropper evasive obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a56048e8079de36a7fd9227/reports/023f2cac-9534-4350-a9b0-8bfdf93d9d73/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-22T12:34:00Z UTC

Last seen:

2026-06-22T13:11:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd/results?tab=lookup

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-22 11:15:22 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 36 (33.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a3vwxxacpden4tq2dlvkkhpof57athi7if5qsdpmyr2dckg4l7oq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

421798ea7bd98b7027ae3965fba2e50464a5c8da3d0b5f77e7bfded1e3dc01f9

AgentTesla

8dffead0450847a53d2c7d585aa2150acc44a4813ecbd31f0e7f6c61d7b08c05

AgentTesla

96e22da4d5c0ea4b0efde0ad3eaa8fdedc60228f84fb3c56899afbb9338da2a1

AgentTesla

bd95b4ee6290007c9804ced47042a7e8b7e4121d3fe82f7ae91e4e8baf4a4585

AgentTesla

dc12faa460faab18a12d8ac33fb3a3a96c95232cff2f124df15300475cc20486

AgentTesla

error

AgentTesla

+ 416 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260714-lprnnaas2k/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd