MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f2d295bca7cb02c5263a780c6d6d334c0c83b926b295cb89dcdcc26b27c6906. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7f2d295bca7cb02c5263a780c6d6d334c0c83b926b295cb89dcdcc26b27c6906
SHA3-384 hash:	76c1ec2e78b44a3de5d50b8d9dab3ac331cbdb5667738b9f56dd2e5058f6d7b6d072b79a8f3e4088273eced8ae53624c
SHA1 hash:	2325c296c4a226361546872f6c043b28f81207fc
MD5 hash:	97216c0b8b24eb38702f574b70e958e4
humanhash:	artist-triple-april-bulldog
File name:	RemittanceVO23081100084673.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'411'176 bytes
First seen:	2025-03-24 12:15:14 UTC
Last seen:	2025-06-19 13:54:34 UTC
File type:	js
MIME type:	text/plain
ssdeep	6144:/eKe9eKe9eKe9eKe9eKe9eKe9eKe9eKe9eKe9eKe9eUeKe9eKe9eKe9eKe9eKe9T:c
Threatray	4'297 similar samples on MalwareBazaar
TLSH	T1E96597495B674C32FDC3299DA83C2D5189DE5EC229E7338CDBB984407D0A46DE7A3236
Magika	javascript
Reporter	abuse_ch
Tags:	AgentTesla js sendxsenses--vetrys-shop

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

399

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e0cdcdbb84e066269e6546

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive obfuscated obfuscated opendir opendir powershell

Link:

https://www.filescan.io/uploads/67e14cf2de7b23ce171da1f0/reports/9f7b8323-8040-43a8-90c6-eb5a497d1b25/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/7f2d295bca7cb02c5263a780c6d6d334c0c83b926b295cb89dcdcc26b27c6906

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla

Result

Threat name:

AgentTesla

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1647069

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7f2d295bca7cb02c5263a780c6d6d334c0c83b926b295cb89dcdcc26b27c6906

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f2d295bca7cb02c5263a780c6d6d334c0c83b926b295cb89dcdcc26b27c6906/

ReversingLabs TitaniumCloud Script-JS.Trojan.Negasteal

Threat name:

Script-JS.Trojan.Negasteal

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-03-24 01:58:42 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p4wssw6kpsycyutdu6amnvwtgtamqo4snmuvzoe5zxgcnmt4neda._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

247b6074981847173c995d1d0a45ebc3cd6b4cf64cbb7fc69e16b749b85023a9

AgentTesla

4af4e807a39641a52d870358fa8b6486927f7f5daeb94a2a75d9e117ba41a3ea

AgentTesla

5a9523bba8e40c9d642fd99e046c4c06ddb7174cb26da584ccc0db4aea139f87

AgentTesla

7b67d0a145d4a5d7c1743269452d08bc56bfcb91d93786a375e288f94dd265f8

AgentTesla

c907b5ee8b9aae5ad661042f2aed0338df90653b95dad072ef8d8c0b582bc46b

AgentTesla

e5ba47d37554211c555170329555afae35d41989297a18bddbf33bfb2d30a6f0

AgentTesla

error

AgentTesla

+ 4'287 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250324-pe9m9szsgs/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Checks computer location settings

Blocklisted process makes network request

AgentTesla

Agenttesla family

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7f2d295bca7c/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7f2d295bca7cb02c5263a780c6d6d334c0c83b926b295cb89dcdcc26b27c6906