MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 482cbda2421163b53a99d8fefc44d8e208557eb851eb651542ec076bdee693b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	482cbda2421163b53a99d8fefc44d8e208557eb851eb651542ec076bdee693b3
SHA3-384 hash:	a45f02f6de0dc6ee59e47b2bfc570f22ad11f6e7e065ffe2cf1babb0b5ebebb0821d4372960ef645b3d4e585b5940c10
SHA1 hash:	b97d6a04191b9471b05d42059afe7d40ba38229b
MD5 hash:	0c20a775bf9a8ce4ffecdf4626d2e84e
humanhash:	zebra-april-fruit-ten
File name:	TT_Copy.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'139'404 bytes
First seen:	2026-07-24 12:18:02 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	49152:2ZGs9s6rDdWM9YgBsGCk2pg8xVTgF4Q4v6RzgYerxISgbgLVaD/5HQFbJkokBNV+:2ZGs9s6rDdWM9YgBsGC/pg8TTgF4Zv6m
TLSH	T1B0E53A5157A4917B7321EBED413ADE38940EA40328D9CF44359EDB28B91CE4BA358BF3
Magika	javascript
Reporter	TomU
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

147

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20260707-1932.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a6358296e2d72c6b55a4313/reports/6a2e50cf-bf5f-4371-94cd-ecabbb59be59/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/482cbda2421163b53a99d8fefc44d8e208557eb851eb651542ec076bdee693b3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-06T07:27:00Z UTC

Last seen:

2026-07-25T10:54:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/482cbda2421163b53a99d8fefc44d8e208557eb851eb651542ec076bdee693b3/results?tab=lookup

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/482cbda2421163b53a99d8fefc44d8e208557eb851eb651542ec076bdee693b3

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/482cbda2421163b53a99d8fefc44d8e208557eb851eb651542ec076bdee693b3/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-06 13:24:22 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 36 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jawl3isccfr3kouz3d7pyrgy4iefk7vykhvwkfkc5qdwxxxgsozq._file

Threatray AgentTesla DonutLoader

Verdict:

malicious

Label(s):

AgentTesla

Alert

Create hunting rule

DonutLoader

Alert

Create hunting rule

Link:

https://reports.threatray.com/f49b0640-7912-4a68-98aa-adf0084ea39c

Similar samples:

147c897e00c759b643fb5dd6afc05be16433f78ecb5ff563f767721c6b502fdd

AgentTesla

1497f3ac5cea6ff1326aff8c3e774fe5a67dff656d1fb9e212307bad5300d9fe

AgentTesla

22664b468509d5a3ef8d156c623b64fd1acf1ebb19d175af6990cfac6178b557

AgentTesla

2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484

AgentTesla

55c8115641754b94a8ad055eecf5bf808e24de267f84d8da4b18112c40b71176

AgentTesla

87d9f4fc7f470e4723c6171d4a9fb3f37998663b84ab46965d2d7d4729fc444e

AgentTesla

c835a3ad655dfbcb2702c257019c549a3706b9331421cb35bd68f612d89f8263

AgentTesla

dd3c857fe1e186c19c7571bb9c0c42747fb2f053b6661e717141d077a1923d9d

AgentTesla

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/260724-pgw5yszcqd/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/482cbda2421163b53a99d8fefc44d8e208557eb851eb651542ec076bdee693b3