MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63c8fd496324f7e8905b93c2906aa817d0ac05da8833dbf5d028c1d728f4b016. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	63c8fd496324f7e8905b93c2906aa817d0ac05da8833dbf5d028c1d728f4b016
SHA3-384 hash:	6b662ea87543a1eff6035397c4b294e9fb67c319e540354b79aeaf2c3a4f1025e93cfdfe70546d7c0205763cd3048929
SHA1 hash:	054b890b6e785f9caa25a3e4bb571f46b67ef71a
MD5 hash:	a60d355bce0554c852c924123b8425a2
humanhash:	five-three-early-mountain
File name:	DetallesXdelXpago-90876565.bz2
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	39'388 bytes
First seen:	2026-09-02 06:06:52 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	768:5n4JwV2uyNSWVynlz5hDsixgL3OtZ4g3MANiLsGYGtJJJF:B4JwUhVY59xg7wZ4wXiLZYGx
TLSH	T1AF03E634365A92EF81DBE714AF23E43C3E113E7E895AB1DAB3D167C74648801E963931
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	lowmal3
Tags:	AgentTesla rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

94

Origin country :

DE

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Detalles del pago-908765656789-08676789-0986.jse
File size:	185'597'952 bytes
SHA256 hash:	782d84fb0880f1d7a91f737c0ed99f2eb7abfd79d5b1c8d1071091f811ee26f6
MD5 hash:	c63181586770e852fe3f21ae0d641127
MIME type:	application/octet-stream
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/8173fc96-4f69-4a67-94c9-bfed54f8a24b/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1e.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis HEUR/Pumpar.Generic

Verdict:

Suspicious

Labled as:

HEUR/Pumpar.Generic

Link:

https://www.hybrid-analysis.com/sample/63c8fd496324f7e8905b93c2906aa817d0ac05da8833dbf5d028c1d728f4b016

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-09-01T20:13:00Z UTC

Last seen:

2026-09-01T20:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/63c8fd496324f7e8905b93c2906aa817d0ac05da8833dbf5d028c1d728f4b016/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/a60d355bce0554c852c924123b8425a2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/63c8fd496324f7e8905b93c2906aa817d0ac05da8833dbf5d028c1d728f4b016/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mpep2sldet36rec3spbja2vic7ikybo2raz5x5oqfda5okhuwala._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260902-k41z7ssyey/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

ConfuserEx .NET packer

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Badlisted process makes network request

Family: AgentTesla

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/63c8fd496324f7e8905b93c2906aa817d0ac05da8833dbf5d028c1d728f4b016