MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4
SHA3-384 hash:	409a22f9d2e091f83fd8f56fc8548bd0f20c4a9ee6d3436313ca070a91160abdea2a7751cb6eaea5b9d5259fc6a4aabd
SHA1 hash:	3dad184503a39570d332e4204bc075fe575d2a12
MD5 hash:	e9c28ab7d94c9262d869e58dfab9883d
humanhash:	three-three-berlin-william
File name:	Nuovo ordine.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	6'690'054 bytes
First seen:	2026-04-15 12:24:00 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:3NpVqgI7Ged0phPjRNs71PC70U9LUBuFQjmvaEOQ:dpIvF2rNii0jjTm
TLSH	T19F66D818C0BDB20E99E3D759B83AE5B04C8F68AB1E4DAD8A240F953D2D05F9355601FF
Magika	javascript
Reporter	JAMESWT_WT
Tags:	AgentTesla ftp-crescentegramas-com-br js sativagina--crescentegramas-com-br Spam-ITA

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

119

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

89.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69df838af68adfe1003a0c77

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug autoit dropper evasive expired-cert fingerprint keylogger obfuscated repaired

Link:

https://www.filescan.io/uploads/69df8385d920e19044fcb014/reports/91aa9e48-2c6c-4123-a317-5d8887a5d681/overview

Hybrid Analysis JS/Obfus.A.gen

Verdict:

Suspicious

Labled as:

JS/Obfus.A.gen

Link:

https://www.hybrid-analysis.com/sample/a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-04-14T17:46:00Z UTC

Last seen:

2026-04-17T07:27:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4/results?tab=lookup

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4/

Neiki Trojan.Script

Verdict:

Malicious

Threat:

Trojan.Script

Link:

https://tip.neiki.dev/file/a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uw6ntf7fihl7x6icmyks4li2j2dyb3dnwf6fqbzdk4nxjtlntlka._file

Threatray agenttesla

Verdict:

malicious

Label(s):

agenttesla

Alert

Create hunting rule

Similar samples:

error

AgentTesla

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader discovery execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/260415-plagradz9q/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a5bcd997e541/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/a5bcd997e541d7fbf90266152e2d1a4e8780ec6db17c580723571b74cd6d9ad4