MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27
SHA3-384 hash:	6d1839443e8cf509e015cd900b09031edd2487a58b54be5fd2d25fb529c0137755db23545eefd8633c54fc21919c8f80
SHA1 hash:	9b3bcee35529ab8dbff186c748c29df2f0455de8
MD5 hash:	fd960fcde32eb18f1b2e0a3adcf999f2
humanhash:	alabama-king-mango-twenty
File name:	MT103.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'293'663 bytes
First seen:	2026-07-13 19:47:42 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:sQmBnsiupkZ3h/1/P174AMoQLb302UgFAdF8e2n+Ft33x5yU3vF0yunBE644uNJH:GBns3pkZh/1/P174AMoQLb302UgFAdFT
Threatray	221 similar samples on MalwareBazaar
TLSH	T14EE5295295E862233320FBED962DDE38940EE4432D198F54798EEB387D2CF89E214757
Magika	javascript
Reporter	James_inthe_box
Tags:	AgentTesla exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

221

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20260713-1832.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5541163d3a766c4391bb7b

Tags:

shell lien sage blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a554110ccd4ae1f05e71f11/reports/2b349f5f-ed73-402d-b1b6-37220111785d/overview

Hybrid Analysis Trojan.GenericFCA

Verdict:

Malicious

Labled as:

Trojan.GenericFCA

Link:

https://www.hybrid-analysis.com/sample/2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-12T19:09:00Z UTC

Last seen:

2026-07-15T17:47:00Z UTC

Hits:

~1000

Detections:

Trojan.Win32.Agent.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb HEUR:Trojan-Dropper.Script.Generic Trojan.Win32.Shellcode.sb Trojan-PSW.MSIL.Agensla.sb Trojan-Dropper.JS.SDrop.sb Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27/results?tab=lookup

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27/

ReversingLabs TitaniumCloud Script-JS.Trojan.Kepavll

Threat name:

Script-JS.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-12 23:24:53 UTC

File Type:

Text (JavaScript)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=frqbczc5vjxkdevgui7pkzdvhyqlj5s6poilpyqc76ckqnp43qtq._file

Threatray donutloader agenttesla

Verdict:

malicious

Label(s):

donutloader

Alert

Create hunting rule

agenttesla

Alert

Create hunting rule

Similar samples:

147c897e00c759b643fb5dd6afc05be16433f78ecb5ff563f767721c6b502fdd

AgentTesla

1497f3ac5cea6ff1326aff8c3e774fe5a67dff656d1fb9e212307bad5300d9fe

AgentTesla

22664b468509d5a3ef8d156c623b64fd1acf1ebb19d175af6990cfac6178b557

AgentTesla

2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484

AgentTesla

5060df36d2b6701839279f5ac009ecf132a4659afd568eafcfa3a215a2b734e8

AgentTesla

53f74990bfd6bf39940b96e2bcf1ae5fc435d1a27b492b8fb128291b06f53b72

AgentTesla

76e089a21b93f2349ca1dacfd8d4fae4b57702f302103a83ca7c0d988991100e

AgentTesla

c835a3ad655dfbcb2702c257019c549a3706b9331421cb35bd68f612d89f8263

AgentTesla

+ 211 additional samples on MalwareBazaar

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection execution keylogger loader persistence spyware stealer trojan

Link:

https://tria.ge/reports/260713-yjdaashx2w/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2c6011645daa/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2c6011645daa6ea192a6a23ef564753e20b4f65e7b90b7e202ff84a835fcdc27