MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d3e4ed2067572db1657b6578aba955d1b7ad82d6daaa68f323f9f729a6b3efe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8d3e4ed2067572db1657b6578aba955d1b7ad82d6daaa68f323f9f729a6b3efe
SHA3-384 hash:	cb1aee617309bd907b54f78ae85cadb7e1a0da390baaace8630b122e809e5bbc6cce674a40728c111dfa1dd85de79e3b
SHA1 hash:	8520343320bac0c79f6e9780d030d8bc28336294
MD5 hash:	4c0de1d9c6a8ce21a559c6b3d126da55
humanhash:	william-hamper-lion-speaker
File name:	SIAD Hungary nr 43627654637_5346353636736376534567.js
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	189'063 bytes
First seen:	2025-04-17 12:48:02 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:DCAfwcarJX2rXkvLv6LDxrTdLjyF/KB5tN+m/GK16WI+3N1COIEqG8db/:lIFX2rXkvL+DRTdalefIe193N87EqG8J
Threatray	757 similar samples on MalwareBazaar
TLSH	T127045C3FCD9EFDC0132F70F2482A369519199F8BBE30069DA7DC7879B43A4495672A09
Magika	javascript
Reporter	smica83
Tags:	AgentTesla HUN js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

513

Origin country :

HU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.8212.31479.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6800fc372203b3e10cd03f87

Tags:

autorun lien

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/6800f89590767142c3d90091/reports/39174195-7ffe-41b5-9edf-3e5cd5701638/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8d3e4ed2067572db1657b6578aba955d1b7ad82d6daaa68f323f9f729a6b3efe

Joe Sandbox AgentTesla, Batch Injector

Result

Threat name:

AgentTesla, Batch Injector

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1667524

Signature

.NET source code contains a sample name check

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Bypasses PowerShell execution policy

Connects to many ports of the same IP (likely port scanning)

Drops script or batch files to the startup folder

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Drops script at startup location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected Batch Injector

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8d3e4ed2067572db1657b6578aba955d1b7ad82d6daaa68f323f9f729a6b3efe

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d3e4ed2067572db1657b6578aba955d1b7ad82d6daaa68f323f9f729a6b3efe/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ru7e5uqgovznwfsxwzlyvouvlunxvwbnnwvkndzsh6pxfgtlh37a._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

130fe56cb2926721957a6c7a1430a7f954a85fd59a612c3e91027c4eb1cadbd1

AgentTesla

29d36377766c12dbb7799774921c28d9ec6c68b99aaa90860d875584e522f73a

AgentTesla

2e1d8dd0bf1511be6665ac5739ae946357fd033b2e8bbac18ab1b9495c2eebfc

AgentTesla

4d25a079e5c17965e6f79e9f47e122aec5b86b5a963525e6c1886d8c7d532e9c

AgentTesla

a9d1f9c94b40e55b169fb37966dc8c89b0ffec5974077975e56bbda4cec452b0

AgentTesla

dd1b8e8b32926abb0494c5d426239c7db7b420c7fc5406b6ee3be24e354cbd14

AgentTesla

error

AgentTesla

f6b6e3664095437f4984389106b6609575fbd411c38f71f696e148ec7df15c14

AgentTesla

+ 747 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla collection discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/250417-p1xktsynt6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Drops startup file

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

AgentTesla

Agenttesla family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.