MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a
SHA3-384 hash:	43664072b318689112b17e66057ede60490c3fa2037b4b007c6818835e01c85ae0041171fb9f36a320335eac6d689343
SHA1 hash:	64898ed9f3717db5c0b57633ae49aec80eeb5b7d
MD5 hash:	b89d524f30d67b824888b8b0f5a4a2e0
humanhash:	network-bulldog-don-alaska
File name:	Purchase Order No. 25-26266.zip
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'462'137 bytes
First seen:	2026-06-18 05:12:44 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:q4Pa0otVlvhoIsWMz8IQ/4HdQYOkxq8veY0ULHK1uCS1o8gnRt/K+raJeQGB364c:hPa0obthtsNzweOks8jBbK1uCx8Uv/y7
TLSH	T19365338DCA1C99A81C42B33C1D34219F57F0B759D31E9A5B28FADBA2C27E63453FA444
Magika	zip
Reporter	cocaman
Tags:	AgentTesla zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

165

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Purchase Order No. 25-26266.JS
File size:	3'642'968 bytes
SHA256 hash:	8dffead0450847a53d2c7d585aa2150acc44a4813ecbd31f0e7f6c61d7b08c05
MD5 hash:	a523a5e6046da45a3d62b64c5bab0618
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7bf13bf1-2a80-4f72-aea4-f235ac6cc0f3/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a305f8334eaf30d8ce6755f

Tags:

spawn lien blic hype

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug base64 dropper evasive masquerade obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a337e8862d0679105f74617/reports/fe36aacc-977c-4383-a68b-0b7a30367756/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-06-17T03:17:00Z UTC

Last seen:

2026-06-18T18:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a/results?tab=lookup

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a/

ReversingLabs TitaniumCloud Script-JS.Spyware.Negasteal

Threat name:

Script-JS.Spyware.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-17 14:26:00 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

14 of 24 (58.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lf5hbptihdq4l6uc4qcuqguckicojj2xtc7lfmgqfxqgtpm5lufa._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260618-g5bvxsfw2n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/597a70be6838e1c5fa82e405481a825204e4a75798beb2b0d02de069bd9d5d0a