MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9
SHA3-384 hash:	9a32967a1c66ea61a85c5086a737203b8465f5023f21003464720959092cb93ed0678881bd467658b10b92e6917cabde
SHA1 hash:	8d03201894a4357aa0b8d59c65cf6573b05eee1e
MD5 hash:	ea0a35a42d684f14e584e8ea9c2dd4d3
humanhash:	robert-snake-ack-hamper
File name:	INVOICE AND PL.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'308'684 bytes
First seen:	2026-07-21 13:23:12 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:a0l36DTiHoHZUrAu98lTiZa6j9IGzYwxTnVfAzwd9DKWfhuKP0SFQV:fcikyAuITiZaWqQYwx7VTzewPrG
TLSH	T1475533E1174A34CFEB56DBA744D3F3C82662AEC82D1363C164E5FA994D1C9B588C7D20
Magika	zip
Reporter	JAMESWT_WT
Tags:	AgentTesla enogcaen-br-com ftp-enogcaen-br-com sambobby--enogcaen-br-com Spam-ITA zip

JAMESWT_WT

 

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	INVOICE AND PL.JS
File size:	3'291'847 bytes
SHA256 hash:	87d9f4fc7f470e4723c6171d4a9fb3f37998663b84ab46965d2d7d4729fc444e
MD5 hash:	f44ea37db819ee43e33195acbf1b225f
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/961862b9-8f29-4604-970a-db061b649adf/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5f72d9bcffb2c48cb7b36f

Tags:

virus lien sage blic

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive masquerade obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a5f72d46951bbd06603a8b0/reports/0d6f8536-c05b-430d-bcc5-4212a1ddf851/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-07-21T08:54:00Z UTC

Last seen:

2026-07-23T10:59:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9/results?tab=lookup

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/ea0a35a42d684f14e584e8ea9c2dd4d3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-21 12:39:16 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hmmeavljtiqf6zivwb63ogri6pbd57fqajhpaddi6kfo2f25i2uq._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection execution keylogger loader persistence spyware stealer trojan

Link:

https://tria.ge/reports/260721-q8mahaae59/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/3b184055699a205f6515b07db71a28f3c23efcb0024ef00c68f28aed175d46a9