MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5514013d690dfff22d7fa5f30a8896481754efd28ed24611ea74c7cfa5898e75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5514013d690dfff22d7fa5f30a8896481754efd28ed24611ea74c7cfa5898e75
SHA3-384 hash:	7730a0bd81e09c7e7bde52daa9664a5157cd05e8b216e622776a0eef02603558aca3245e6c5941f9e8566331e30599be
SHA1 hash:	7b1d49c2dfd68336e5fe1a1c2d33f4ca0cf0357a
MD5 hash:	36ab5d5048d0a62ae10819f0c00a5dfb
humanhash:	berlin-hamper-lake-failed
File name:	PO-2603113056899.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'291'847 bytes
First seen:	2026-07-24 12:19:49 UTC
Last seen:	2026-07-24 12:35:32 UTC
File type:	js
MIME type:	text/plain
ssdeep	98304:WbQvWRftf+Ru1NsES0u5PYukk9u2V5kQTuQA+jxbgd+UHmEouatnK:GYWR1+RcNsESPwoViQTCfgUHmEovtK
TLSH	T1C5E52B4087386571696DD72CD13A9F68094F3043609DEF1D35FA0728BAAAF27A34D9E3
Magika	javascript
Reporter	TomU
Tags:	AgentTesla js

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

152

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a6358dde18e7a43a1e99ee1/reports/cba3fb28-e7d4-4e99-851e-572570b5f37e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5514013d690dfff22d7fa5f30a8896481754efd28ed24611ea74c7cfa5898e75

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-13T10:27:00Z UTC

Last seen:

2026-07-25T11:11:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/5514013d690dfff22d7fa5f30a8896481754efd28ed24611ea74c7cfa5898e75/results?tab=lookup

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5514013d690dfff22d7fa5f30a8896481754efd28ed24611ea74c7cfa5898e75

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/5514013d690dfff22d7fa5f30a8896481754efd28ed24611ea74c7cfa5898e75/

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-13 21:07:48 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 36 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kukacpljbx77ell7uxzqvcewjalvj36sr3jemepkotd47jmjrz2q._file

Threatray AgentTesla DonutLoader

Verdict:

malicious

Label(s):

AgentTesla

Alert

Create hunting rule

DonutLoader

Alert

Create hunting rule

Link:

https://reports.threatray.com/5a00c998-95ae-4b02-a1f8-582b5033b4fc

Similar samples:

147c897e00c759b643fb5dd6afc05be16433f78ecb5ff563f767721c6b502fdd

AgentTesla

1497f3ac5cea6ff1326aff8c3e774fe5a67dff656d1fb9e212307bad5300d9fe

AgentTesla

22664b468509d5a3ef8d156c623b64fd1acf1ebb19d175af6990cfac6178b557

AgentTesla

2e264065cf67a4b630a899e8fad202e0a6b8a3158e9f01e904b482d200986484

AgentTesla

55c8115641754b94a8ad055eecf5bf808e24de267f84d8da4b18112c40b71176

AgentTesla

87d9f4fc7f470e4723c6171d4a9fb3f37998663b84ab46965d2d7d4729fc444e

AgentTesla

c835a3ad655dfbcb2702c257019c549a3706b9331421cb35bd68f612d89f8263

AgentTesla

dd3c857fe1e186c19c7571bb9c0c42747fb2f053b6661e717141d077a1923d9d

AgentTesla

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection execution keylogger loader persistence spyware stealer trojan

Link:

https://tria.ge/reports/260724-pjg4tadr6w/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/5514013d690dfff22d7fa5f30a8896481754efd28ed24611ea74c7cfa5898e75