MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bfb1cfd0b05ffac2f9d4236c8decdc8681bce52b2839332aa1e38bcde43462f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8bfb1cfd0b05ffac2f9d4236c8decdc8681bce52b2839332aa1e38bcde43462f
SHA3-384 hash:	408f52e479aee7a473f4761e31fa1525f760bbefd5c650d3786aae4b8c281403b74b8ae0a295e9c282fa723cdfb2a01f
SHA1 hash:	3884ea86a5e084c7dc4e9beabcf50de0165164e9
MD5 hash:	43025fd695c379acd3efbe459a99e8c9
humanhash:	social-stream-magazine-shade
File name:	Invoice No. 9296.ace
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'002'883 bytes
First seen:	2026-03-31 06:48:27 UTC
Last seen:	Never
File type:	ace
MIME type:	application/x-ace-compressed
ssdeep	24576:9IoGgrIMzLrxF4HtCKxSGh/hYGMqG99fYjxIOsa:95Bn3bYtCKxvMjH9qx
TLSH	T1EA253313D2FFB740EB5B6357396C3795A5AAE21DD0B8C9C1A33C9D895ECA901BC60D08
Magika	ace
Reporter	lowmal3
Tags:	ace AgentTesla

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

44

Origin country :

DE

Vendor Threat Intelligence

ACCE

Gathering data

ClamAV Detected

Detection(s):

Sanesecurity.Malware.27192.AceHeur.Js.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.26219.AceHeur.js.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Ace_js.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-ACE-js.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cb6e6a3a18a6e1ddeff50e

Tags:

virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/69cb6e6900ad36369408911a/reports/f77782e7-b2e1-41b0-a754-a01cebeb04d4/overview

Hybrid Analysis Mal/DrodAce

Verdict:

Suspicious

Labled as:

Mal/DrodAce

Link:

https://www.hybrid-analysis.com/sample/8bfb1cfd0b05ffac2f9d4236c8decdc8681bce52b2839332aa1e38bcde43462f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ace

First seen:

2026-03-30T08:15:00Z UTC

Last seen:

2026-03-31T20:44:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/8bfb1cfd0b05ffac2f9d4236c8decdc8681bce52b2839332aa1e38bcde43462f/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8bfb1cfd0b05ffac2f9d4236c8decdc8681bce52b2839332aa1e38bcde43462f/

Neiki Family.AGENTTESLA

Verdict:

Malicious

Threat:

Family.AGENTTESLA

Link:

https://tip.neiki.dev/file/8bfb1cfd0b05ffac2f9d4236c8decdc8681bce52b2839332aa1e38bcde43462f

ReversingLabs TitaniumCloud Script-JS.Trojan.AgentTesla

Threat name:

Script-JS.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-30 11:09:54 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

12 of 23 (52.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rp5rz7ilax72yl45ii3mrxwnzbubxtsswkbzgmvkdy4lzxsdiyxq._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla defense_evasion discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/260331-hsvmyafy4k/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

Malware Config

C2 Extraction:

https://api.telegram.org/bot8271047137:AAEexDI10mt9IUeumEpriGOSFf1ITlCIW-0/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8bfb1cfd0b05ffac2f9d4236c8decdc8681bce52b2839332aa1e38bcde43462f