MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5
SHA3-384 hash:	1778448bfd5f6fc5d3842755d52263b7d2817f1337deb42a32639c4addfaa45316dfb2019ba54da6b5c9b991be45932a
SHA1 hash:	81da216e41a70e01b20c11e484f17c708d2b254d
MD5 hash:	73af9274eb29b24eefda6f0ad028d4d5
humanhash:	red-ten-football-cat
File name:	BANK_PAYMENT_ADVICE09345.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'117'737 bytes
First seen:	2026-04-29 08:08:12 UTC
Last seen:	2026-04-30 10:19:20 UTC
File type:	js
MIME type:	text/plain
ssdeep	49152:sm8fbrdXdhW5/2APgtUVhZuYAenAWYjv38YEtPPblzjSnFRWRiGrLAhWNP56IlW/:sm8fbrddhW5/2APgtUVhZulenOjv35E4
TLSH	T11DE52991675B9432A67DE71CD53AEA704A0E201325CADF1D306E93383A14E1B935FEE3
Magika	javascript
Reporter	jahlives
Tags:	AgentTesla exe-in-archive js spamtrap

Intelligence

---

File Origin

# of uploads :

13

# of downloads :

164

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive masquerade obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/69f1bc76594172aacc5006c3/reports/111b33a1-1d5a-4b04-89f0-f4f7ddcad85a/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-04-29T02:48:00Z UTC

Last seen:

2026-05-01T06:01:00Z UTC

Hits:

~10000

Detections:

Trojan.Win32.Agent.sb Trojan-PSW.MSIL.Agensla.sb PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan.Win32.Shellcode.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan-Dropper.Script.Generic

Link:

https://opentip.kaspersky.com/2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5/

Neiki Family.DONUTLOADER

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5

ReversingLabs TitaniumCloud Script-JS.Trojan.Malgent

Threat name:

Script-JS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-29 05:57:58 UTC

File Type:

Binary

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fnsftuuv4sljxbjo7qm2ei5cw4pxjwlsl54fn6tx3z2lrxy3e6sq._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

error

AgentTesla

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader discovery execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/260429-j1pmbshs8x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VMRay DonutLoader

Malware family:

DonutLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2b6459d295e4/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2b6459d295e4969b852efc19a223a2b71f74d9725f7856fa77de74b8df1b27a5