MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118
SHA3-384 hash:	8a518eaa1188492592a9cdc4c394998917236de31b6063c0555f58ceeadcb234892de8bde756ea6c1a65a81e892a54b8
SHA1 hash:	86e9ff3bb8ee40ce38d922ff74d78caaea98fed7
MD5 hash:	ef8f13b261d94fd7723c1063ed3775d0
humanhash:	timing-seventeen-finch-chicken
File name:	2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118.rar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	2'267'593 bytes
First seen:	2026-07-14 09:39:46 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:TEteX6dhMO/Q45zEnLkUlqt4gVg0zrejccDkLaE7cC05CcW:TeS2FQMzEwUIex0mPkv7n0ocW
TLSH	T1BEA5339BEF32275E6C55DC598B23722C8834D8360FF5331B7915C2091AD6BCA99F2D0A
Magika	zip
Reporter	JAMESWT_WT
Tags:	AgentTesla ftp-enogcaen-br-com zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

68

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	gjawhixj.JS
File size:	4'056'536 bytes
SHA256 hash:	488bc747c7643f0e411b2793b51edbbabe0451107fcf6ceaaa8f2f78125a476e
MD5 hash:	7ec887b0b4ababc2c3dfc0384367d303
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3306d4f0-4a8f-4cfc-ba0a-0aa873213840/

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-168.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.32567.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a56044556bd89099b5532fa

Tags:

autorun autoit emotet

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug autoit dropper evasive fingerprint keylogger lolbin obfuscated persistence reconnaissance repaired schtasks

Link:

https://www.filescan.io/uploads/6a56042800365ee31d84985c/reports/9e1c9e05-6fe4-486b-ad5c-0505d44751fa/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-05-11T03:05:00Z UTC

Last seen:

2026-06-03T07:19:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/ef8f13b261d94fd7723c1063ed3775d0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118/

ReversingLabs TitaniumCloud Script-JS.Spyware.Negasteal

Threat name:

Script-JS.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-11 13:10:04 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

14 of 36 (38.89%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fvjnggn24nyx3drfz4w5b5hdjufcuv6ab7jue3ckibxmxgjjeema._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection discovery execution keylogger loader persistence spyware stealer trojan

Link:

https://tria.ge/reports/260714-lvftcaat4k/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2d52d319bae3717d8e25cf2dd0f4e34d0a2a57c00fd3426c4a406ecb99292118