MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a087a0ab7eb3cfa171eaa960c65e9144e244d83c1b40f3e63faf13e77efee33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0a087a0ab7eb3cfa171eaa960c65e9144e244d83c1b40f3e63faf13e77efee33
SHA3-384 hash:	71c89b0763660b0a81b7433e3eb5154ac268ee15b875d7de6ba5cf8f2a57f8f51a940551d24b222a7e928bdaf41c0de8
SHA1 hash:	d81d5994e05e4c2d89a32adccf543f305f3ce7f6
MD5 hash:	bf473c73109d3e60cad6105499e0e0ff
humanhash:	uranus-october-timing-beer
File name:	Payment_advice.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'797'261 bytes
First seen:	2026-08-17 12:14:17 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	49152:mpC1EsHgSJ/rSfLF8MI+1hHJcG7wnTqTuakMi:mpq1HgSJ/rsLFRI+jHJcTnTo8Mi
TLSH	T1BE065E761604D920F56DB21CF1F6FA68731D122B1AAAAB1D317CD1062B72E122F78CF5
Magika	json
Reporter	James_inthe_box
Tags:	AgentTesla exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

192

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20260816-2133.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive masquerade obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a82fb1cef413e566f8b0137/reports/48e9a91f-8f36-4355-9d9b-b5315e08ef21/overview

Hybrid Analysis Trojan.GenericFCA

Verdict:

Malicious

Labled as:

Trojan.GenericFCA

Link:

https://www.hybrid-analysis.com/sample/0a087a0ab7eb3cfa171eaa960c65e9144e244d83c1b40f3e63faf13e77efee33

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-16T09:40:00Z UTC

Last seen:

2026-08-17T08:59:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/0a087a0ab7eb3cfa171eaa960c65e9144e244d83c1b40f3e63faf13e77efee33/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/0a087a0ab7eb3cfa171eaa960c65e9144e244d83c1b40f3e63faf13e77efee33/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-16 13:36:53 UTC

File Type:

Text (JavaScript)

AV detection:

9 of 24 (37.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=biehucvx5m6pufy6vklayzpjcrhcitmdyg2a6ptd7lyt457p5yzq._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260817-pegmgszzfx/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/0a087a0ab7eb3cfa171eaa960c65e9144e244d83c1b40f3e63faf13e77efee33