MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1c52ad030451f2cd931d7793119030a519470ee13b3f2ce3aa62ff381d6e5ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a1c52ad030451f2cd931d7793119030a519470ee13b3f2ce3aa62ff381d6e5ee
SHA3-384 hash:	e471463cd43a8241ab17aebe25b73165c55a380aa92299835fbb8424731a110d6e2455057657a8c4fb4098788035c148
SHA1 hash:	a3b69540a780b36fe95a1aad56885dab720ab936
MD5 hash:	7feea5ec5d2c4b997eec6dddf0269741
humanhash:	table-island-sink-burger
File name:	RFQ_2601.rar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	1'354'209 bytes
First seen:	2026-10-14 15:08:45 UTC
Last seen:	2026-10-14 15:10:40 UTC
File type:	rar
MIME type:	application/vnd.rar
ssdeep	24576:o9EBUmcpAAZXkKC7MI7uS7RLzuahyHEp2e6/WOiCBjqdkrmlom:oQUJaSI6ALmHeOTAl/
TLSH	T15E55336E036462513418F329E1FBFE0ABE9764A9DEDDB068C78712D443B003A578F4E9
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	AgentTesla rar

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

49

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	RFQ 2601.JS
File size:	4'141'339 bytes
SHA256 hash:	aa95aab22e9f666dacac24e95f57c3230fad3d0e3bd4e12e159289ba37f0fede
MD5 hash:	6c3bf5adb38346e6cd7e02151777b13d
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ad02e8f1-b1a1-4ac1-bf2c-a2d40a53fa26/

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Muldrop.1408.18667.1212.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac3bfe5cd73065edfcd3d29

Tags:

virus lien blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6acf9b288f9b8ca99d0dae50/reports/dd5605de-22d6-4454-aa4f-bda15660aeaa/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/a1c52ad030451f2cd931d7793119030a519470ee13b3f2ce3aa62ff381d6e5ee

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-08-28T06:37:00Z UTC

Last seen:

2026-10-11T07:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a1c52ad030451f2cd931d7793119030a519470ee13b3f2ce3aa62ff381d6e5ee/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/7feea5ec5d2c4b997eec6dddf0269741

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a1c52ad030451f2cd931d7793119030a519470ee13b3f2ce3aa62ff381d6e5ee/

ReversingLabs TitaniumCloud Script-JS.Trojan.AgentTesla

Threat name:

Script-JS.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-07 17:24:00 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uhcsvubqiupszwjr254tcgidbjizi4hocoz7ftr2uyx7haow4xxa._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection discovery execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/261014-s3x6xse15v/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/a1c52ad030451f2cd931d7793119030a519470ee13b3f2ce3aa62ff381d6e5ee