MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abb333a4d96bea3077cee41d779e33cd996c75ce1840d82e908703882f8af45b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	abb333a4d96bea3077cee41d779e33cd996c75ce1840d82e908703882f8af45b
SHA3-384 hash:	24a7903e277bc05d11941d6bb87bd2298d6565ba151fac24b4f90a2a8ba49a96b98e58e98e2350b41cf42fab51a2bf1e
SHA1 hash:	aa64c7598e25e37d92ce0cac6385115df13d85e4
MD5 hash:	85330be169c4e29891e4626eeae0b4bd
humanhash:	uniform-grey-timing-music
File name:	COTIZACIÓN-0970-90-PDF.rar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	63'062 bytes
First seen:	2025-12-11 08:54:58 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	1536:NSxam9YgYzgQrVi+ewNdenVgF8Emd/8+RKdLpcOKPhAjYR6:NSxDSgXQYwNdek8EK/8GG9ihJ6
TLSH	T1A4539E38379AA5DB8199E75E9B13F0343D41BD3A811B68D7FBD0F283894C0A89916E35
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	lowmal3
Tags:	AgentTesla rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

91

Origin country :

DE

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	COTIZACIÓN-0970-9078756687659659689796568765768687.jse
File size:	150'994'944 bytes
SHA256 hash:	cee502db6ebd18082eddf5e2e55dc6d621a9522ebbdf7d305a9d46edfd420223
MD5 hash:	8600135d6a3e79edb38c709459bf7c38
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b2b31d2e-2e53-4593-b87b-a2d83233d826/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1e.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=693a86f6bde6a3e597102d2c

Tags:

ransomware shell blic

Hybrid Analysis HEUR/Pumpar.Generic

Verdict:

Suspicious

Labled as:

HEUR/Pumpar.Generic

Link:

https://www.hybrid-analysis.com/sample/abb333a4d96bea3077cee41d779e33cd996c75ce1840d82e908703882f8af45b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2025-12-10T17:31:00Z UTC

Last seen:

2025-12-11T22:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/abb333a4d96bea3077cee41d779e33cd996c75ce1840d82e908703882f8af45b/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/85330be169c4e29891e4626eeae0b4bd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/abb333a4d96bea3077cee41d779e33cd996c75ce1840d82e908703882f8af45b/

Neiki Trojan-Downloader.Script

Verdict:

Malicious

Threat:

Trojan-Downloader.Script

Link:

https://tip.neiki.dev/file/abb333a4d96bea3077cee41d779e33cd996c75ce1840d82e908703882f8af45b

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-10 23:47:41 UTC

AV detection:

7 of 38 (18.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vozthjgznpvda56o4qoxphrtzwmwy5oodbanqluqq4byql4k6rnq._file

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla discovery execution keylogger spyware stealer trojan

Link:

https://tria.ge/reports/251211-pvta8abx6d/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Badlisted process makes network request

AgentTesla

Agenttesla family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/abb333a4d96bea3077cee41d779e33cd996c75ce1840d82e908703882f8af45b