MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bc7a6540ac5984e13ac22b807a4724986bb179f9bcf81cab987cfab8e155d3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5bc7a6540ac5984e13ac22b807a4724986bb179f9bcf81cab987cfab8e155d3c
SHA3-384 hash:	745c734843600c8b2e8b7adc92e8d3878fabdd31c24b14ebdc05df808e56dd1d06b41e457e398031652b8f6e93fdcdba
SHA1 hash:	338ce8d9974422d93bc5f99388cf69f7ff486d19
MD5 hash:	a4b72990aed4489533cca2b488886417
humanhash:	lemon-rugby-oxygen-nuts
File name:	5bc7a6540ac5984e13ac22b807a4724986bb179f9bcf81cab987cfab8e155d3c.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	5'208'673 bytes
First seen:	2025-09-10 12:55:58 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:caGW9ZEqk/gyQ8IJBhG/T/YceMlb+TpGyiFlF94NxU+6uR:caVzOAbhG/b3lb+TpGFlF94NxU+zR
Threatray	3'908 similar samples on MalwareBazaar
TLSH	T17A369140FE0666C4CB175D7E3E207FAD1CE5E2BB63E7B71C36216CD2AA24844A1E2D15
Magika	javascript
Reporter	JAMESWT_WT
Tags:	AgentTesla info-abdh-gmbh-de js LOSTINSPACE

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

128

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.JS.Obfus-2179.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.JS.Obfus-2525.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c175876e66ba602d79d8ac

Tags:

obfuscate xtreme spawn lien

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm base64 obfuscated overlay powershell

Link:

https://www.filescan.io/uploads/68c1759a732879482925815d/reports/198193ab-2f74-42ef-97cd-8d4fbf34f906/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/5bc7a6540ac5984e13ac22b807a4724986bb179f9bcf81cab987cfab8e155d3c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2025-09-10T04:56:00Z UTC

Last seen:

2025-09-10T04:56:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/5bc7a6540ac5984e13ac22b807a4724986bb179f9bcf81cab987cfab8e155d3c/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/5bc7a6540ac5984e13ac22b807a4724986bb179f9bcf81cab987cfab8e155d3c/

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/5bc7a6540ac5984e13ac22b807a4724986bb179f9bcf81cab987cfab8e155d3c

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-09-10 07:56:46 UTC

File Type:

Binary

AV detection:

5 of 38 (13.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lpd2mvakywme4e5mek4apjdsjgdlwf47tphydsvzq7h2xdqvlu6a._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

10364e0c6aee6b43975fd53d6289dd7e6e0f7891d4a5636cb938f68e00717d85

AgentTesla

4a974b7fb576b2183acefabf17ef453bd4503e5d25e8e5853d56b9c8a9a8c3ff

AgentTesla

6ea4db068135afc1c4b04d0942b9352405623cb8bf2a6d9a5fc3c4c04bb0cc28

AgentTesla

error

AgentTesla

fd9dbcc0a59475ba77d799f67faeefe4264cbdec6b1a45180bd6104568a5ac52

AgentTesla

+ 3'898 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250910-p6vcnayqx7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

Malware Config

Dropper Extraction:

https://heuang.unaux.com/docx/file2.jpg

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.