MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29c85fdb8eb5813d953a96b97e086e2eb99a7ee841ac5c8cfedeae99ad236195. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	29c85fdb8eb5813d953a96b97e086e2eb99a7ee841ac5c8cfedeae99ad236195
SHA3-384 hash:	b3bbf3019a52e937a3b502c9fa88bad3f44c6cc92b18d6062158445a034b666e13debbefa46fdaeb160d555eab11565c
SHA1 hash:	0cb947b07814fb43c83fa2d73d897348f87103e6
MD5 hash:	2942dec06ceae84b6dcbba37a86e2066
humanhash:	twelve-queen-mexico-july
File name:	DHL Delivery Notification - Scheduled for 8th August.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	2'311 bytes
First seen:	2025-08-04 07:20:19 UTC
Last seen:	2025-08-05 09:00:40 UTC
File type:	js
MIME type:	text/plain
ssdeep	48:q1I+TES37X4W4kumo6QzqkVyxAtwNreVU+pZXCD5tFfgeD0nq9oae:Erh37oWPjXkAywte6+2D5tFfFD0naoV
TLSH	T166414E8C3D4170840F1282A7AD2B8C0BA726DF59900AC60DE132F4D43D28739EBAF6B0
Magika	javascript
Reporter	Anonymous
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

12

# of downloads :

64

Origin country :

PL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.7443.23361.13024.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68905f71af3050dc8d340ba2

Tags:

dropper spawn small

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 evasive masquerade packed

Link:

https://www.filescan.io/uploads/68905f7132e61090868c4dd4/reports/46841427-1ce7-4646-af83-4a3c8fe7e236/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Suspicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/29c85fdb8eb5813d953a96b97e086e2eb99a7ee841ac5c8cfedeae99ad236195

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/29c85fdb8eb5813d953a96b97e086e2eb99a7ee841ac5c8cfedeae99ad236195

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/29c85fdb8eb5813d953a96b97e086e2eb99a7ee841ac5c8cfedeae99ad236195/

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/29c85fdb8eb5813d953a96b97e086e2eb99a7ee841ac5c8cfedeae99ad236195

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-04 00:09:01 UTC

File Type:

Text (JavaScript)

AV detection:

9 of 36 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fhef7w4owwat3fj2s24x4cdof24zu7xiigwfzdh632xjtljdmgkq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

error

AgentTesla

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla discovery execution keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/250804-h6ajxsynw2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Blocklisted process makes network request

AgentTesla

Agenttesla family

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/29c85fdb8eb5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.